summaryrefslogtreecommitdiffstats
path: root/sys-utils/setpriv.1
Commit message (Collapse)AuthorAgeFilesLines
* setpriv: add --reset-envKarel Zak2018-08-221-0/+9
| | | | | | | | | | | Clear environment in way like su(1), but PATH is set to hard-coded defaults and /etc/login.defs is not used at all (I guess we want to keep setpriv(1) simple). If you need anything more advanced than use env(1). Addresses: https://github.com/karelzak/util-linux/issues/325 Signed-off-by: Karel Zak <kzak@redhat.com>
* setpriv: allow to use group name for --groupsKarel Zak2018-08-221-1/+1
| | | | | Addresses: https://github.com/karelzak/util-linux/issues/325 Signed-off-by: Karel Zak <kzak@redhat.com>
* man: Use the correct macro for a font change of one argumentBjarni Ingi Gislason2018-05-231-4/+4
| | | | | | | | Use the correct macro (I, B) for the font change of one argument, not those that are used for alternating two fonts, like "BR", "IR", "RB", or "RI". Signed-off-by: Bjarni Ingi Gislason <bjarniig@rhi.hi.is>
* setpriv: implement option to set parent death signalPatrick Steinhardt2018-04-101-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a process uses the syscall `prctl(PR_SET_PDEATHSIG, ...)`, it will get notified with a process-defined signal as soon as its parent process dies. This is for example being used by unshare(1)'s recently added "--kill-child" option, causing the forked child to be killed as soon as unshare itself dies. Unfortunately, some LSMs will cause the parent death signal to be reset when a process changes credentials, with the most important ones being SELinux and AppArmor. The following command will thus not work as expected: unshare --fork --kill-child setpriv --reuid user <executable> As soon as setpriv changes UID, the parent death signal is cleared and the child will never get signalled when unshare gets killed. Add a new option "--pdeathsig keep|clear|<signal>". Setting this flag will cause us to either - restore the previously active parent death signal as soon as the setpriv has applied all credential changes - clear the parent death signal - set the parent death signal to "<signal>" Furthermore, print out the currently set signal when dumping process state. [kzak@redhat.com: - small changes in codding style] Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Karel Zak <kzak@redhat.com>
* setpriv: add example sectionSam Morris2018-03-081-1/+15
|
* setpriv: include --init-groups in the list of options that can be specified ↵Sam Morris2018-03-081-2/+3
| | | | with --[re]gid
* setpriv: improve description in man pageSam Morris2018-03-081-5/+16
|
* setpriv: fix manpage typoSam Morris2018-03-061-1/+1
| | | | | | The example given in the man page didn't work. Judging by commit db663995bd93e170a43b1a7050c7a738782dabfb, --inh-caps= used to be called --caps= but the man page was not updated after the change was made.
* setpriv: document accepted formats for naming capsPatrick Steinhardt2017-08-011-1/+6
| | | | | | | | | | | | Since commit fbd15c4d4 (setpriv: support setting unnamed capabilities, 2017-07-17), it is possible to name capabilities not only by name, but also by their index. While using the human-readable name is usually recommended, using the index may be required in case new capabilities have been introduced to the kernel for which we have no name yet. The newly introduce format format is not documented inside of setpriv(1), though, which is being fixed in this commit. Signed-off-by: Patrick Steinhardt <ps@pks.im>
* setpriv: support modifying the set of ambient capabilitiesPatrick Steinhardt2017-06-271-3/+5
| | | | | | | | | | | | | | | | | | | Right now, we do not support modifying the set of ambient capabilities, which has been introduced quite recently with Linux 4.3. As libcap-ng does not yet provide any ability to modify this set, we do have to roll our own support via `prctl`, which is now easy to do due to the indirections introduced in the preceding commits. We add a new command line argument "--ambient-caps", which uses the same syntax as both "--inh-caps" and "--bounding-set" to specify either adding or dropping capabilities. This commit also adjusts documentation to mention the newly introduced ability to modify the ambient capability set. Based on a patch by Andy Lutomirski. Reviewed-by: Andy Lutomirski <luto@kernel.org> Signed-off-by: Patrick Steinhardt <ps@pks.im>
* setpriv: Add --init-groups optionSebastian Schrader2017-06-051-0/+8
| | | | | Add an --init-groups option which initializes the supplementary groups from the system's group database (e.g /etc/group) using initgroups(3).
* docs: replace FTP by HTTPS in kernel.org URLsSébastien Helleu2016-12-191-1/+1
| | | | | | | The links to ftp://ftp.kernel.org/ are replaced by https://www.kernel.org/. Signed-off-by: Karel Zak <kzak@redhat.com>
* docs: various pages: Use 'UID" and "GID", not "uid" and "gid" in man pagesMichael Kerrisk2016-12-091-2/+2
| | | | Signed-off-by: Michael Kerrisk <mtk.man-pages@gmail.com>
* docs: various pages: Use consistent terminology (set-user-ID and set-group-ID)Michael Kerrisk2016-12-091-2/+4
| | | | | | | | | | Use consistent terminology for set-user-ID and set-group-ID bits. There's much inconsistency in the pages. "suid", "set-user-identifier", "setuid". Stick with one terminology, "set-user-ID" and set-grout-ID, as suggested in man-pages(7). Signed-off-by: <mtk.man-pages@gmail.com>
* docs: various pages: Use "system call" not "syscall"Michael Kerrisk2016-12-051-1/+1
| | | | | | A minor wording fix... Signed-off-by: Michael Kerrisk <mtk.man-pages@gmail.com>
* Place SEE ALSO entries in orderMichael Kerrisk (man-pages)2016-11-291-1/+1
| | | | | | | | | | | | This patch does only the following: * Order SEE ALSO entries first by section name, then alphabetically within section * Adds one or two missing commas in SEE ALSO lists * Removes one or two periods that were (inconsistently) used at the end of SEE ALSO lists. Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
* Fix typo in page cross reference (capabilities(7), not, capability(7))Michael Kerrisk (man-pages)2016-11-291-1/+1
| | | | Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
* su, runuser, setpriv: create links between man pagesKarel Zak2016-08-181-0/+7
| | | | | | | .. and add notes about differences between the utuils. Reported-by: Lennart Poettering <lennart@poettering.net> Signed-off-by: Karel Zak <kzak@redhat.com>
* docs: restore minus symbols in long optsJ William Piggott2015-01-211-6/+6
| | | | Signed-off-by: J William Piggott <elseifthen@gmx.com>
* docs: fix some things that were overlooked during the first passBenno Schulenberg2014-07-281-51/+51
| | | | | | | Mainly more option sorting, some formatting adjustments, and the adding of a missing --version here and there. Signed-off-by: Benno Schulenberg <bensberg@justemail.net>
* docs: bring five more man pages closer to standard formattingBenno Schulenberg2014-07-211-43/+49
| | | | | | | Also, for renice, adapt the descriptions to the behaviour: the -g, -p and -u options do not actually need to be followed by any ID. Signed-off-by: Benno Schulenberg <bensberg@justemail.net>
* docs: standardize the phrases for --help and --version in all man pagesBenno Schulenberg2013-10-151-1/+1
| | | | Signed-off-by: Benno Schulenberg <bensberg@justemail.net>
* standard SEE ALSO section of man pagesMike Frysinger2013-05-131-1/+1
| | | | | | | | The standard format is to seperate each entry with a comma, and for each one to be on a line by itself. Most util-linux pages follow this, but a few do not. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* setpriv: allow login and group name option argumentsSami Kerola2013-04-261-2/+4
| | | | | | For an average user names are easier to use than uid and gid numbers. Signed-off-by: Sami Kerola <kerolasa@iki.fi>
* setpriv: run a program with different Linux privilege settingsAndy Lutomirski2013-02-051-0/+149
This new command can set no_new_privs, uid, gid, groups, securebits, inheritable caps, the cap bounding set, securebits, and selinux and apparmor labels. [kerolasa@iki.fi: a lot of small adjustment making the command to be good fit to util-linux project] Signed-off-by: Sami Kerola <kerolasa@iki.fi> Signed-off-by: Andy Lutomirski <luto@amacapital.net>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-06-03 07:27:56 +0200