diff --git a/man2/setfsuid.2 b/man2/setfsuid.2 index 8918af37e..ba6ad7964 100644 --- a/man2/setfsuid.2 +++ b/man2/setfsuid.2 @@ -1,4 +1,5 @@ .\" Copyright (C) 1995, Thomas K. Dyas +.\" and Copyright (C) 2013, 2019, Michael Kerrisk .\" .\" %%%LICENSE_START(VERBATIM) .\" Permission is granted to make and distribute verbatim copies of this @@ -36,29 +37,34 @@ setfsuid \- set user identity used for filesystem checks .PP .BI "int setfsuid(uid_t " fsuid ); .SH DESCRIPTION -The system call +On Linux, a process has both a filesystem user ID and an effective user ID. +The (Linux-specific) filesystem user ID is used +for permissions checking when accessing filesystem objects, +while the effective user ID is used for various other kinds +of permissions checks (see +.BR credentials (7)). +.PP +Normally, the value of the process's filesystem user ID +is the same as the value of its effective user ID. +This is so, because whenever a process's effective user ID is changed, +the kernel also changes the filesystem user ID to be the same as +the new value of the effective user ID. +A process can cause the value of its filesystem user ID to diverge +from its effective user ID by using .BR setfsuid () -changes the value of the caller's filesystem user ID\(emthe -user ID that the Linux kernel uses to check for all accesses -to the filesystem. -Normally, the value of -the filesystem user ID -will shadow the value of the effective user ID. -In fact, whenever the -effective user ID is changed, -the filesystem user ID -will also be changed to the new value of the effective user ID. +to change its filesystem user ID to the value given in +.IR fsuid . .PP Explicit calls to .BR setfsuid () and .BR setfsgid (2) -are usually used only by programs such as the Linux NFS server that +are (were) usually used only by programs such as the Linux NFS server that need to change what user and group ID is used for file access without a corresponding change in the real and effective user and group IDs. A change in the normal user IDs for a program such as the NFS server -is a security hole that can expose it to unwanted signals. -(But see below.) +is (was) a security hole that can expose it to unwanted signals. +(However, this issue is historical; see below.) .PP .BR setfsuid () will succeed only if the caller is the superuser or if