mirror of
https://git.openafs.org/openafs.git
synced 2025-01-19 07:20:11 +00:00
03b9fcc883
Complete an initial editing and cleanup pass for all section one man pages. Fix various conversion problems, formatting inconsistencies, and obvious problems. Please note that no editing for content has yet been done; this is solely editing for formatting and correct conversion to POD. Also, add some additional section five man pages that were omitted from the first conversion run due to unusual file names, and globally replace CAVEATS with CAUTIONS in the man pages to match the original section name. The section one man pages should now be in reasonable shape and ready for additional review and further updates, although there are probably still remaining obvious problems. ==================== This delta was composed from multiple commits as part of the CVS->Git migration. The checkin message with each commit was inconsistent. The following are the additional commit messages. ==================== This file got the wrong name when it was originally committed. Fix.
101 lines
3.4 KiB
Plaintext
101 lines
3.4 KiB
Plaintext
=head1 NAME
|
|
|
|
fs setcell - Configures permissions for setuid programs from specified cells
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
B<fs setcell> B<-cell> <I<cell name>>+ [B<-suid>] [B<-nosuid>] [B<-help>]
|
|
|
|
B<fs setce> B<-c> <I<cell name>>+ [B<-s>] [B<-n>] [B<-h>]
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The B<fs setcell> command sets whether the Cache Manager allows programs
|
|
(and other executable files) from each cell named by the B<-cell> argument
|
|
to run with setuid permission. By default, the Cache Manager allows
|
|
programs from its home cell to run with setuid permission, but not
|
|
programs from any foreign cells. A program belongs to the same cell as the
|
|
file server machine that houses the volume in which the program's binary
|
|
file resides, as specified in the file server machine's
|
|
F</usr/afs/etc/ThisCell> file. The Cache Manager determines its own home
|
|
cell by reading the F</usr/vice/etc/ThisCell> file at initialization.
|
|
|
|
To enable programs from each specified cell to run with setuid permission,
|
|
include the B<-suid> flag. To prohibit programs from running with setuid
|
|
permission, include the B<-nosuid> flag, or omit both flags.
|
|
|
|
The B<fs setcell> command directly alters a cell's setuid status as
|
|
recorded in kernel memory, so rebooting the machine is unnecessary.
|
|
However, non-default settings do not persist across reboots of the machine
|
|
unless the appropriate B<fs setcell> command appears in the machine's AFS
|
|
initialization file.
|
|
|
|
To display a cell's setuid status, issue the B<fs getcellstatus> command.
|
|
|
|
=head1 CAUTIONS
|
|
|
|
AFS does not recognize effective UID: if a setuid program accesses AFS
|
|
files and directories, it does so using the current AFS identity of the
|
|
AFS user who initialized the program, not of the program's owner. Only
|
|
the local file system recognizes effective UID.
|
|
|
|
Only members of the system:administrators group can turn on the setuid
|
|
mode bit on an AFS file or directory.
|
|
|
|
When the setuid mode bit is turned on, the UNIX C<ls -l> command displays
|
|
the third user mode bit as an C<s> instead of an C<x>. However, the C<s>
|
|
does not appear on an AFS file or directory unless setuid permission is
|
|
enabled for the cell in which the file resides.
|
|
|
|
=head1 OPTIONS
|
|
|
|
=over 4
|
|
|
|
=item B<-cell> <I<cell name>>+
|
|
|
|
Names each cell for which to set setuid status. Provide the fully
|
|
qualified domain name, or a shortened form that disambiguates it from the
|
|
other cells listed in the local F</usr/vice/etc/CellServDB> file.
|
|
|
|
=item B<-suid>
|
|
|
|
Allows programs from each specified cell to run with setuid
|
|
privilege. Provide it or the B<-nosuid> flag, or omit both flags to
|
|
disallow programs from running with setuid privilege.
|
|
|
|
=item B<-nosuid>
|
|
|
|
Prevents programs from each specified cell from running with setuid
|
|
privilege. Provide it or the B<-suid> flag, or omit both flags to disallow
|
|
programs form running with setuid privilege.
|
|
|
|
=item B<-help>
|
|
|
|
Prints the online help for this command. All other valid options are
|
|
ignored.
|
|
|
|
=back
|
|
|
|
=head1 EXAMPLES
|
|
|
|
The following command enables executable files from the State University
|
|
cell to run with setuid privilege on the local machine:
|
|
|
|
% fs setcell -cell stateu.edu -suid
|
|
|
|
=head1 PRIVILEGE REQUIRED
|
|
|
|
The issuer must be logged in as the local superuser root.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<fs_getcellstatus(1)>
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|