Commit Graph

19813 Commits

Author SHA1 Message Date
Michael Kerrisk 7ef57ea1a0 sigaction.2: Minot tweaks to Eugene Syromyatnikov's patch
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 11:05:50 +01:00
Eugene Syromyatnikov e1836e9d9e sigaction.2: Describe obsolete usage of struct sigcontext as signal handler argument
* man2/sigaction.2 (.SS Undocumented): Provide information about
  relation between the second argument of sa_handler and
  uc_mcontext field of the struct ucontext structure.

Signed-off-by: Eugene Syromyatnikov <evgsyr@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 10:53:22 +01:00
Michael Kerrisk e4092d5e51 fcntl.2: Briefly explain the meaning of the 'l_sysid' field in 'struct flock'
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 10:50:46 +01:00
Eugene Syromyatnikov 27ede97d14 fcntl.2: Mention that l_sysid is not used even if present
Some architectures do provide an 'l_sysid' declaration in
struct flock; however, it is not used anyway.

* man2/fcntl.2 (.SH NOTES): Note that l_sysid field is not used on
Linux even if present on some architectures.

Signed-off-by: Eugene Syromyatnikov <evgsyr@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 10:49:32 +01:00
bert hubert 2ca483cd4b ip.7: IP_RECVTTL error fixed
I need to get the TTL of UDP datagrams from userspace, so I set
the IP_RECVTTL socket option.  And as promised by ip.7, I then get
IP_TTL messages from recvfrom.  However, unlike what the manpage
promises, the TTL field gets passed as a 32 bit integer.

The following userspace code works:

  uint32_t ttl32;
  for (cmsg = CMSG_FIRSTHDR(msgh); cmsg != NULL; cmsg = CMSG_NXTHDR(msgh,cmsg)) {
    if ((cmsg->cmsg_level == IPPROTO_IP) && (cmsg->cmsg_type == IP_TTL) &&
        CMSG_LEN(sizeof(ttl32)) == cmsg->cmsg_len) {

      memcpy(&ttl32, CMSG_DATA(cmsg), sizeof(ttl32));
      *ttl=ttl32;
      return true;
    }
    else
      cerr<<"Saw something else "<<(cmsg->cmsg_type == IP_TTL) <<
		", "<<(int)cmsg->cmsg_level<<", "<<cmsg->cmsg_len<<", "<<
		CMSG_LEN(1)<<endl;
  }

The 'else' field was used to figure out I go the length wrong.

Note from mtk:

Reading the source code also seems to confirm this, from
net/ipv4/ip_sockglue.c:

[[
static void ip_cmsg_recv_ttl(struct msghdr *msg, struct sk_buff *skb)
{
        int ttl = ip_hdr(skb)->ttl;
        put_cmsg(msg, SOL_IP, IP_TTL, sizeof(int), &ttl);
}
]]

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 10:49:09 +01:00
Michael Kerrisk c3a208e9d9 capget.2: Remove first paragraph, which repeats details from capabilities(7)
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 10:48:57 +01:00
Michael Kerrisk 241771957c capget.2: Relocate a misplaced sentence
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 9f92e4e1cb capabilities.7: tfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk ed474f00fe gettid.2: Glibc provides a wrapper since version 2.30
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 563bf760bf setns.2: When joining a user namespace, it must be a descendant user namespace
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 4312e0cb67 capabilities.7: CAP_SYS_CHROOT allows use of setns() to change the mount namespace
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk dd61e8a8f4 capabilities.7: srcfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 9c5b11bf42 capabilities.7: Add a subsection on per-user-namespace "set-user-ID-root" programs
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk bcf7072dbd capabilities.7: Relocate the subsection "Interaction with user namespaces"
This best belongs at the end of the page, after the subsections
that already make some mention of user namespaces.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 049d1a1534 capabilities.7: wfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 33d0916f81 capabilities.7: Substantially rework "Capabilities and execution of programs by root"
Rework for improved clarity, and also to include missing details
on the case where (1) the binary that is being executed has
capabilities attached and (2) the real user ID of the process is
not 0 (root) and (3) the effective user ID of the process is 0
(root).

Kernel code analysis and some test code (GPLv3 licensed) below.

======

My analysis of security/commoncaps.c capabilities handling
(from Linux 4.20 source):

execve() eventually calls __do_execve_file():

__do_execve_file()
  |
  +-prepare_bprm_creds(&bprm)
  |  |
  |  +-prepare_exec_creds()
  |  |  |
  |  |  +-prepare_creds()
  |  |     |
  |  |     | // Returns copy of existing creds
  |  |     |
  |  |     +-security_prepare_creds()
  |  |        |
  |  |        +-cred_prepare() [via hook]
  |  |           // Seems to do nothing for commoncaps
  |  |
  |  // Returns creds provided by prepare_creds()
  |
  // Places creds returned by prepare_exec_creds() in bprm->creds
  |
  |
  +-prepare_binprm(&bprm) // bprm from prepare_bprm_creds()
     |
     +-bprm_fill_uid(&bprm)
     |
     |  // Places current credentials into bprm
     |
     |  // Performs set-UID & set-GID transitions if those file bits are set
     |
     +-security_bprm_set_creds(&bprm)
        |
        +-bprm_set_creds(&bprm) [via hook]
           |
           +-cap_bprm_set_creds(&bprm)
              |
              // effective = false
              |
              +-get_file_caps(&bprm, &effective, &has_fcap)
              |  |
              |  +-get_vfs_caps_from_disk(..., &vcaps)
              |  |
              |  |  // Fetches file capabilities from disk and places in vcaps
              |  |
              |  +-bprm_caps_from_vfs_caps(&vcaps, &bprm, &effective, &has_fcap)
              |
              |     // If file effective bit is set: effective = true
              |     //
              |     // If file has capabilities: has_fcap |= true
              |     //
              |     // Perform execve transformation:
              |     //     P'(perm) = F(inh) & P(Inh) | F(Perm) & P(bset)
              |
              +-handle_privileged_root(&bprm, has_fcap, &effective, root_uid)
              |
              |  // If has_fcap && (rUID != root && eUID == root) then
              |  //     return without doing anything
              |  //
              |  // If rUID == root || eUID == root then
              |  //    P'(perm) = P(inh) | P(bset)
              |  //
              |  // If eUID == root then
              |  //     effective = true
              |
              // Perform execve() transformation:
              //
              //     P'(Amb) = (privprog) ? 0 : P(Amb)
              //     P'(Perm) |= P'(Amb)
              //     P'(Eff) = effective ? P'(Perm) : P'(Amb)

Summary

1. Perform set-UID/set-GID transformations

2. P'(Amb) = (privprog) ? 0 : P(Amb)

3. If [process has nonzero UIDs] OR
   ([file has caps] && [rUID != root && eUID == root]), then

        P'(perm) = F(inh) & P(Inh) | F(Perm) & P(bset) | P'(Amb)

   else // ~ [process has rUID == root || eUID == root]

        P'(perm) = P(inh) | P(bset) | P'(Amb)

4. P'(Eff) = (F(eff) || eUID == root) ? P'(Perm) : P'(Amb)

======

$ cat show_creds_and_caps_long.c

int
main(int argc, char *argv[])
{
    uid_t ruid, euid, suid;
    gid_t rgid, egid, sgid;
    cap_t caps;
    char *s;

    if (getresuid(&ruid, &euid, &suid) == -1) {
        perror("getresuid");
        exit(EXIT_FAILURE);
    }

    if (getresgid(&rgid, &egid, &sgid) == -1) {
        perror("getresgid");
        exit(EXIT_FAILURE);
    }

    printf("UID: %5ld (real), %5ld (effective), %5ld (saved)\n",
            (long) ruid, (long) euid, (long) suid);
    printf("GID: %5ld (real), %5ld (effective), %5ld (saved)\n",
            (long) rgid, (long) egid, (long) sgid);

    caps = cap_get_proc();
    if (caps == NULL) {
        perror("cap_get_proc");
        exit(EXIT_FAILURE);
    }
    s = cap_to_text(caps, NULL);
    if (s == NULL) {
        perror("cap_to_text");
        exit(EXIT_FAILURE);
    }
    printf("Capabilities: %s\n", s);

    cap_free(caps);
    cap_free(s);

    exit(EXIT_SUCCESS);
}

$ cat cred_launcher.c

                        } while (0)

                        do { fprintf(stderr, "Usage: "); \
                             fprintf(stderr, msg, progName); \
                             exit(EXIT_FAILURE); } while (0)

int
main(int argc, char *argv[])
{
    uid_t r, e, s;

    if (argc != 5 || strcmp(argv[1], "--help") == 0)
        usageErr("%s rUID eUID sUID <prog>\n", argv[0]);

    r = atoi(argv[1]);
    e = atoi(argv[2]);
    s = atoi(argv[3]);

    if (setresuid(r, e, s) == -1)
        errExit("setresuid");

    if (getresuid(&r, &e, &s) == -1)
        errExit("getresuid");

    execv(argv[4], &argv[4]);
    errExit("execve");
}

$ cc -o cred_launcher cred_launcher.c
$ cc -o show_creds_and_caps_long show_creds_and_caps_long.c -lcap

$ sudo ./cred_launcher 1000 0 1000 ./show_creds_and_caps_long
UID:  1000 (real),     0 (effective),     0 (saved)
GID:     0 (real),     0 (effective),     0 (saved)
Capabilities: =ep

$ sudo setcap cap_kill=pe show_creds_and_caps_long
$ sudo ./cred_launcher 1000 0 1000 ./show_creds_and_caps_long
UID:  1000 (real),     0 (effective),     0 (saved)
GID:     0 (real),     0 (effective),     0 (saved)
Capabilities: = cap_kill+ep

The final program execution above shows the special casing
that occurs in handle_privileged_root() for the case where:

    rUID != root && eUID == root && [file has capabilities]

======

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk cc0fb214da capabilities.7: tfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 1a9ed17c9e capabilities.7: Improve the discussion of when file capabilities are ignored
The text stated that the execve() capability transitions are not
performed for the same reasons that setuid and setgid mode bits
may be ignored (as described in execve(2)). But, that's not quite
correct: rather, the file capability sets are treated as empty
for the purpose of the capability transition calculations.

Also merge the new 'no_file_caps' kernel option text into the
same paragraph.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk f6acfeb8f8 capabilities.7: Document the 'no_file_caps' kernel command-line option
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 962f9d0969 capget.2: Remove crufty sentence suggesting use of deprecated functions
Remove crufty sentence suggesting use of deprecated capsetp(3) and
capgetp(3); the manual page for those functions has long (at least
as far back as 2007) noted that they are deprecated.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 21:58:23 +01:00
Michael Kerrisk 3cc069d5d8 setfsgid.2, setfsuid.2: wfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-16 07:52:30 +01:00
Michael Kerrisk bc1950ac92 capabilities.7: Rework discussion of exec and UID 0, correcting a couple of details
Clarify the "Capabilities and execution of programs by root"
section, and correct a couple of details:

* If a process with rUID == 0 && eUID != 0 does an exec,
  the process will nevertheless gain effective capabilities
  if the file effective bit is set.
* Set-UID-root programs only confer a full set of capabilities
  if the binary does not also have attached capabilities.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-10 03:40:15 +01:00
Michael Kerrisk db18d67f21 capabilities.7: srcfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-07 11:40:25 +01:00
Michael Kerrisk 1873715c21 namespaces.7: srcfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-07 02:07:28 +01:00
Michael Kerrisk 619dbe1c6d cgroups.7: wfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-02 19:48:15 +01:00
Michael Kerrisk 397d130a87 proc.5: SEE ALSO: add htop(1) and pstree(1)
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-01 01:37:03 +01:00
Michael Kerrisk bca7fbb53a proc.5: Since Linux 4.5, "stack:" is no longer shown in /proc/PID/maps
Reported-by: Nick Gregory <ghost@capsule8.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-25 09:08:57 +13:00
Ignat Loskutov 4f53f6aca8 fsync.2: tfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-25 09:00:38 +13:00
Michael Kerrisk dcd7215c2a io_submit.2: ffix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-25 08:59:54 +13:00
Jeff Moyer 19dc28eb9d io_submit.2: Fix the description of aio_data
aio_data is not a kernel-internal field.

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-25 08:59:19 +13:00
Stephan Knauss 3a57505269 proc.5: Mention /proc/uptime includes time spent in suspend
fs/proc/uptime.c:uptime_proc_show() fetches time using
ktime_get_boottime which includes the time spent in suspend.

Signed-off-by: Stephan Knauss <linux@stephans-server.de>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-25 08:53:25 +13:00
Michael Kerrisk 4b1c2041f4 cgroups.7: Reframe the text on delegation to include more details about cgroups v1
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-23 22:17:17 +01:00
Michael Kerrisk 2b91ed4e5f cgroups.7: wfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-23 22:17:17 +01:00
Michael Kerrisk 51629a3000 cgroups.7: wfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-23 22:17:17 +01:00
Michael Kerrisk 87b18a8b63 cgroups.7: Soften the discussion about delegation in cgroups v1
Balbir pointed out that v1 delegation was not an accidental
feature.

Reported-by: Balbir Singh <bsingharora@gmail.com>
Reported-by: Marcus Gelderie <redmnic@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-23 22:17:17 +01:00
Michael Kerrisk e366c4d48d cgroups.7: wfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-23 22:17:17 +01:00
Jakub Wilk dff4ddae77 time.1: Update bug reporting address
Update the bug reporting email address to that shown by

     /bin/time --help

Signed-off-by: Jakub Wilk <jwilk@jwilk.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-17 08:36:08 +13:00
Jakub Wilk 6f25f547da man.7: tfix
Use \(aq for ASCII apostrophes and \(ga for backtick,
as recommended by groff_man(7).

Signed-off-by: Jakub Wilk <jwilk@jwilk.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-17 08:33:58 +13:00
Lucas Werkmeister a25c60362b close.2: ffix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-16 05:39:14 +13:00
Michael Kerrisk b221633b17 time.1: Document the -q/--quiet option
Reported-by: Johannes Altmanninger <aclopte@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-12 21:50:00 +01:00
Michael Kerrisk 8d150d79a2 localedef.1: Minor tweaks to Howard Johnson's patch
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 17:04:35 +13:00
Howard Johnson 5e09392b8a localedef.1: Note that -f and -c, are reversed from what you might expect
I was reading the local-gen bash script, looking for why I'm
getting locale errors, when I noticed that localdef's -f and -c
options were named, in what I think, is a very confusing way.

   -c is the same as --force, and

   -f charmapfile is the same as --charmap=charmapfile.

Yes, it would have been better if they're names had been reversed,
like this:

   -f is the same as --force, and

   -c charmapfile is the same as --charmap=charmapfile.

But given what they are, I thought it would be helpful to give a
heads up to watch for their irregular naming.  I hope I've worded
it appropriately.

I'm not ccing this to anyone else, (i.e. developers, etc), as
these features work as described in the man page.  They're just
confusing.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 17:01:46 +13:00
Michael Kerrisk ebbb02651e bstring.3: Correct argument list for memmem() prototype
Reported-by: Emil Fihlman <emil.fihlman@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 13:38:42 +13:00
Jakub Wilk 2280e53cd2 Changes.old: tfix
Signed-off-by: Jakub Wilk <jwilk@jwilk.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 13:38:42 +13:00
Xiao Yang 8eb09b1283 bsd_signal.3: Fix the wrong version of _POSIX_C_SOURCE
According to the latest glibc, the bsd_signal() function is just
declared when POSIX.1-2008 (or newer) instead of POSIX.1-2001 is
not set since glibc v2.26.

Please see the following code from signal/signal.h:
-----------------------------------------------------------------
/* The X/Open definition of `signal' conflicts with the BSD version.
   So they defined another function `bsd_signal'.  */
extern __sighandler_t bsd_signal (int __sig, __sighandler_t __handler)
     __THROW;
-----------------------------------------------------------------

Signed-off-by: Xiao Yang <yangx.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 13:38:37 +13:00
Michael Kerrisk 1be4da28c5 feature_test_macros.7: Add more detail on why FTMs must be defined before including any header
Reported-by: Andreas Westfeld <andreas.westfeld@htw-dresden.de>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 13:01:03 +13:00
Michael Kerrisk c3a4afcae0 Merge branch 'master' of ra.kernel.org:/pub/scm/docs/man-pages/man-pages 2019-01-10 07:01:44 +13:00
Michael Kerrisk 385a5b3dea errno.3: Mention that errno(1) is part of the 'moreutils' package
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 06:50:25 +13:00
Michael Kerrisk 352c4c5ca6 open.2: Minor fixes to Eugene's patch
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 06:42:35 +13:00
Eugene Syromiatnikov 6deb3733ac open.2: Mention presence of unused O_RSYNC definition
O_RSYNC is defined in <asm/fcntl.h> on HP PA-RISC, but is not
used anyway.

Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-01-10 06:35:10 +13:00