Commit Graph

3555 Commits

Author SHA1 Message Date
Michael Kerrisk 2e3023c413 execve.2, setfsgid.2, setfsuid.2, splice.2, fopen.3, malloc_trim.3, posix_memalign.3, stdarg.3, sysconf.3, tsearch.3, elf.5, hostname.7, inode.7: tstamp
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-05-09 09:43:09 +02:00
Jakub Wilk 60ae21db4c intro.1, execve.2, getcontext.3, passwd.5, bpf-helpers.7: wfix
Use gender-neutral pronouns.

Signed-off-by: Jakub Wilk <jwilk@jwilk.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-05-06 14:49:18 -05:00
Florian Weimer 921e2cfd1f hostname.7: HOSTALIASES/search path processing is DNS-specific
Other NSS modules do not necessarily honor these settings.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-05-04 13:35:07 -05:00
Michael Kerrisk aa6e1bee0e mount_namespaces.7: Minor fix: remove a crufty sentence
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-05-04 07:58:17 -05:00
Michael Kerrisk 4954c465ef mount_namespaces.7: wfix: "parent directory" ==> "parent mount"
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-05-04 07:57:39 -05:00
Jakub Wilk c30acaebb9 man-pages.7: tfix
Escape hyphen.

Signed-off-by: Jakub Wilk <jwilk@jwilk.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-20 08:53:00 +01:00
Jakub Wilk 1caf9454ee man-pages.7: spfix
The section "Example Programs ..." was renamed to "Example programs ..."
(with lowercase p) in c634028ab5, but the reference was not
updated.

Signed-off-by: Jakub Wilk <jwilk@jwilk.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-20 08:52:43 +01:00
Michael Kerrisk d08cb7ae9a inode.7: Add references to execve(2) to describe set-UID/set-GID behaviors
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-12 06:49:15 +01:00
Michael Kerrisk 76028487eb inode.7: wfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-12 06:39:04 +01:00
Michael Kerrisk 0f0a2e4d15 inode.7: Note that timestamp fields measure time starting at the Epoch
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-12 06:26:24 +01:00
Michael Kerrisk 59c0f675ae inode.7: Timestamp fields are structures that include a nanosecond component
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-12 06:15:58 +01:00
Michael Kerrisk 937d74fa42 inode.7: wfix: Remove crufty text
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-12 06:00:09 +01:00
Michael Kerrisk e91fc44670 cgroups.7: wfix
Reported-by: Elias Benali <stackptr@users.sourceforge.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-08 17:36:31 +01:00
Marcus Huewe 335c23653f socket.7: tfix
Signed-off-by: Marcus Huewe <suse-tux@gmx.de>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-08 16:26:19 +01:00
Michael Kerrisk 880c3f67ef Removed trailing white space at end of lines 2019-03-06 17:18:15 +01:00
Michael Kerrisk 8d1b260e8d bpf-helpers.7: wfix: fix TH line
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-06 15:19:37 +01:00
Michael Kerrisk 9ba0180298 getent.1, iconv.1, ldd.1, locale.1, localedef.1, memusage.1, memusagestat.1, pldd.1, sprof.1, time.1, _syscall.2, accept.2, add_key.2, adjtimex.2, bind.2, bpf.2, capget.2, chown.2, chroot.2, clock_getres.2, clone.2, connect.2, copy_file_range.2, epoll_ctl.2, epoll_wait.2, eventfd.2, fanotify_init.2, fanotify_mark.2, fcntl.2, fsync.2, futex.2, getcpu.2, getdents.2, getgid.2, getgroups.2, getpid.2, gettid.2, gettimeofday.2, getuid.2, getxattr.2, inotify_add_watch.2, inotify_init.2, ioctl_fat.2, ioctl_ns.2, ioctl_userfaultfd.2, ioprio_set.2, kcmp.2, kexec_load.2, keyctl.2, listxattr.2, lseek.2, madvise.2, memfd_create.2, migrate_pages.2, mount.2, mprotect.2, mremap.2, msgctl.2, msgop.2, nfsservctl.2, open_by_handle_at.2, perf_event_open.2, pipe.2, pivot_root.2, pkey_alloc.2, poll.2, posix_fadvise.2, prctl.2, readahead.2, readdir.2, readlink.2, reboot.2, recvmmsg.2, removexattr.2, rename.2, request_key.2, s390_guarded_storage.2, s390_runtime_instr.2, s390_sthyi.2, sched_setaffinity.2, sched_setattr.2, sched_setparam.2, seccomp.2, select.2, select_tut.2, semctl.2, sendmmsg.2, set_thread_area.2, setgid.2, setns.2, setuid.2, setxattr.2, shmctl.2, sigaction.2, signalfd.2, sigsuspend.2, socket.2, socketpair.2, spu_run.2, stat.2, statx.2, subpage_prot.2, syscalls.2, sysctl.2, tee.2, timer_create.2, timerfd_create.2, truncate.2, uname.2, unshare.2, userfaultfd.2, ustat.2, vmsplice.2, write.2, CPU_SET.3, __ppc_get_timebase.3, alloca.3, argz_add.3, asprintf.3, backtrace.3, basename.3, bsd_signal.3, bstring.3, bswap.3, bzero.3, cacos.3, cacosh.3, catan.3, catanh.3, catgets.3, clock_getcpuclockid.3, cmsg.3, confstr.3, ctermid.3, ctime.3, des_crypt.3, dl_iterate_phdr.3, dlinfo.3, dlsym.3, duplocale.3, end.3, endian.3, errno.3, exec.3, exit.3, ferror.3, fgetws.3, fmemopen.3, fnmatch.3, fopencookie.3, fputws.3, frexp.3, ftw.3, get_nprocs_conf.3, get_phys_pages.3, getaddrinfo.3, getaddrinfo_a.3, getdate.3, getgrouplist.3, getifaddrs.3, getline.3, getlogin.3, getmntent.3, getnameinfo.3, getopt.3, getpass.3, getprotoent_r.3, getpwnam.3, getservent_r.3, getsubopt.3, glob.3, gnu_get_libc_version.3, hsearch.3, if_nameindex.3, index.3, inet.3, inet_net_pton.3, inet_pton.3, insque.3, isatty.3, iswblank.3, iswspace.3, lockf.3, makecontext.3, mallinfo.3, malloc.3, malloc_hook.3, malloc_info.3, mallopt.3, matherr.3, mbrtowc.3, mbsnrtowcs.3, mbsrtowcs.3, mbstowcs.3, mbtowc.3, mcheck.3, memchr.3, mq_getattr.3, mq_notify.3, newlocale.3, nl_langinfo.3, offsetof.3, perror.3, posix_spawn.3, printf.3, pthread_attr_init.3, pthread_cancel.3, pthread_cleanup_push.3, pthread_getattr_default_np.3, pthread_getattr_np.3, pthread_getcpuclockid.3, pthread_mutexattr_setrobust.3, pthread_rwlockattr_setkind_np.3, pthread_setaffinity_np.3, pthread_setname_np.3, pthread_setschedparam.3, pthread_sigmask.3, putenv.3, qsort.3, rand.3, random.3, readdir.3, regex.3, resolver.3, rpmatch.3, rtime.3, scanf.3, sem_wait.3, setaliasent.3, setbuf.3, stpcpy.3, stpncpy.3, strcat.3, strchr.3, strcmp.3, strcpy.3, strdup.3, strerror.3, strfromd.3, strfry.3, strftime.3, string.3, strlen.3, strnlen.3, strsep.3, strstr.3, strtok.3, strtol.3, strtoul.3, strverscmp.3, strxfrm.3, system.3, termios.3, trunc.3, wcpcpy.3, wcpncpy.3, wcrtomb.3, wcscat.3, wcscpy.3, wcslen.3, wcsncat.3, wcsncmp.3, wcsncpy.3, wcsnlen.3, wcsnrtombs.3, wcsrtombs.3, wcsstr.3, wcstok.3, wcstombs.3, wcwidth.3, wprintf.3, xcrypt.3, console_codes.4, dsp56k.4, full.4, initrd.4, lirc.4, loop.4, st.4, tty.4, vcs.4, charmap.5, core.5, host.conf.5, locale.5, proc.5, repertoiremap.5, resolv.conf.5, termcap.5, tmpfs.5, tzfile.5, aio.7, capabilities.7, cgroup_namespaces.7, cgroups.7, charsets.7, complex.7, epoll.7, fanotify.7, feature_test_macros.7, inotify.7, ip.7, locale.7, man-pages.7, man.7, namespaces.7, pid_namespaces.7, pkeys.7, pthreads.7, rtld-audit.7, sched.7, signal.7, sock_diag.7, socket.7, tcp.7, udp.7, unicode.7, user_namespaces.7, utf-8.7, zdump.8, zic.8: tstamp
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-03-06 15:12:10 +01:00
Michael Kerrisk 5f3523f8ea man.7: SEE ALSO: remove mdoc.samples(7)
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-27 22:20:57 +01:00
Michael Kerrisk 16ff7dba82 mdoc.7, mdoc.samples.7: Remove these pages
groff_mdoc(7) from the groff project provides a better
equivalent of mdoc.samples(7) and the 'mandoc' project
provides a better mdoc(7). And nowadays, there are virtually
no pages in "man-pages" that use mdoc markup.

So, drop these pages.

From a conversation on linux-man with Ingo Schwarz:

[[
Subject: Re: [groff] [PATCH] man7/mdoc_samples.7: srcfix: Avoid a warning about a wrong section
Date: Wed, 27 Feb 2019 15:28:19 +0100

> The two actual problems are both within the Linux man-pages project,
> not within groff:
>
>  1. While back in the early 1990ies, Cynthia Livingston's
>     mdoc.samples(7) manual page was an important document and the
>     de-facto language definition of the mdoc(7) language, it has
>     been outdated for a long time now.  The current groff_mdoc(7)
>     manual page is based on it but contains large numbers of important
>     improvements by Werner Lemberg and others.  As an alternative
>     language definition that is slightly more concise without being
>     less precise and complete, the mdoc(7) manual page is available
>     from the mandoc(1) distribution (mandoc.bsd.lv).  If there are
>     any contradictions between groff_mdoc(7) and mdoc(7), those are
>     unintended and i ought to fix them.
>
>     So i really believe that the Linux man-pages project ought to
>     stop distributing the woefully outdated mdoc.samples(7) manual
>     page.  If you want to include documentation for the mdoc language,
>     i suggest that you either include a copy of the current version
>     of the groff_mdoc(7) manual from the groff(1) distribution or
>     of the mdoc(7) manual from the mandoc(1) distribution, whichever
>     you think harmonizes better with the Linux man-pages project.
>     Both are BSD-style licensed, so there should be no licensing
>     issues.
>
>     I'm not sure whether it is better for you to include or not
>     include it.  There is probably value in having mdoc(7) documentation
>     out of the box with the Linux man-pages project.  Then again,
>     having groff_mdoc(7) in both the Linux man-pages package and
>     in the groff package - or having mdoc(7) in both the Linux
>     man-pages project and the mandoc(1) package - might cause
>     packaging conflicts for some distributions.  I don't rightly
>     know how such conflicts are typically handled by Linux
>     distributions.  Not being able to install the Linux man-pages
>     pages project, groff(1) and mandoc(1) all together on the same
>     Linux machine would certainly be a bad situation...
>
>     By the way, the mdoc(7) manual page distributed by the Linux
>     man-pages project also makes very little sense.  It is a partial
>     repetition of information from groff_mdoc(7)/[mandoc-]mdoc(7),
>     but so compressed that it is mostly unintelligible.  Besides,
>     it is incomplete: e.g. .Lk, .Mt, .Dx, .Ox, .Nx, .Ta, .%U, .Bk,
>     .Ek, .Lb, .In, .Ft, .Ms, .Brq, .Bro, .Brc, .Ex are missing -
>     it seems outdated by at lest 25 years.  Also, some claims are
>     outright wrong - for example, you *cannot* use .UR/.UE in an
>     mdoc(7) document, and i cannot remember ever having seen an
>     implementation of a .UN macro anywhere.  Some macros descriptions
>     are also wrong, e.g. .Fd is *not* intended for "function
>     declarations", and .Vt is *not* "Fortran only".  And so on.
>
>  2. I don't recommend keeping the old mdoc.samples(7) and mdoc(7)
>     manual pages, but if you think you must do that for some reason,
>     then you must at least revert this bogus commit:

I am *not at all* attached to keeping to these pages. Their
presence in the project has always felt a bit anomalous to me.

Back when I took over maintainership in 2004, there were a small
number of pages that used mdoc markup, and so it seemed wise
to keep these pages. Over time, most of those few pages were
converted to 'man' markup, and today the only other page in the
project that still uses mdoc markup is in queue(3). So, there is
just about zero value in having 'mdoc' documentation come with
the "Linux man-pages" box.

Since I seldom use mdoc markup myself, I've had no reason to
monitor pages such as groff_mdoc(7) or the mdoc(7) page
provided my ther 'mandoc' project and compare them with
the pages provided by "Linux man-pages". Now I've had a
closer look. It's sad.

I've removed mdoc(7) and mdoc.samples(7) from "Linux -man-pages".
]]

Reported-by: Ingo Schwarze <schwarze@usta.de>
2019-02-27 15:32:50 +01:00
Michael Kerrisk 2223d7df7e bpf-helpers.7: Refresh against Linux 5.0-rc8
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-27 15:32:50 +01:00
Michael Kerrisk d1a719857b locale.1, memusage.1, pldd.1, _syscall.2, add_key.2, bind.2, bpf.2, chown.2, clone.2, copy_file_range.2, eventfd.2, execve.2, futex.2, getdents.2, getrlimit.2, ioctl_fat.2, ioctl_ns.2, kcmp.2, kexec_load.2, keyctl.2, listxattr.2, lseek.2, membarrier.2, memfd_create.2, mmap.2, mprotect.2, msgop.2, open_by_handle_at.2, perf_event_open.2, pipe.2, readdir.2, readlink.2, readv.2, recvmmsg.2, request_key.2, sched_setaffinity.2, seccomp.2, select.2, select_tut.2, sendmmsg.2, setns.2, signalfd.2, spu_run.2, stat.2, sysctl.2, tee.2, timer_create.2, timerfd_create.2, truncate.2, uname.2, unshare.2, userfaultfd.2, ustat.2, wait.2, CPU_SET.3, __ppc_get_timebase.3, argz_add.3, asprintf.3, backtrace.3, basename.3, bswap.3, bzero.3, cacos.3, cacosh.3, catan.3, catanh.3, catgets.3, clock_getcpuclockid.3, confstr.3, ctime.3, dl_iterate_phdr.3, dlinfo.3, duplocale.3, encrypt.3, end.3, endian.3, fgetws.3, fmemopen.3, fopencookie.3, fputws.3, frexp.3, ftw.3, get_nprocs_conf.3, get_phys_pages.3, getaddrinfo.3, getaddrinfo_a.3, getdate.3, getgrouplist.3, getifaddrs.3, getline.3, getlogin.3, getopt.3, getpass.3, getprotoent_r.3, getpwnam.3, getservent_r.3, getsubopt.3, glob.3, gnu_get_libc_version.3, hsearch.3, if_nameindex.3, index.3, inet.3, inet_net_pton.3, inet_pton.3, insque.3, iswblank.3, iswspace.3, makecontext.3, mallinfo.3, malloc_hook.3, malloc_info.3, mallopt.3, matherr.3, mbrtowc.3, mbsnrtowcs.3, mbsrtowcs.3, mbstowcs.3, mbtowc.3, mcheck.3, memchr.3, mq_getattr.3, mq_notify.3, newlocale.3, nl_langinfo.3, offsetof.3, perror.3, posix_spawn.3, printf.3, pthread_attr_init.3, pthread_cancel.3, pthread_cleanup_push.3, pthread_create.3, pthread_getattr_default_np.3, pthread_getattr_np.3, pthread_getcpuclockid.3, pthread_mutexattr_setrobust.3, pthread_setaffinity_np.3, pthread_setname_np.3, pthread_setschedparam.3, pthread_sigmask.3, qsort.3, rand.3, readdir.3, regex.3, rpmatch.3, rtime.3, scanf.3, sem_wait.3, setaliasent.3, setbuf.3, stpcpy.3, stpncpy.3, strcat.3, strchr.3, strcpy.3, strdup.3, strerror.3, strfromd.3, strftime.3, strlen.3, strnlen.3, strsep.3, strstr.3, strtok.3, strtol.3, strtoul.3, strverscmp.3, strxfrm.3, termios.3, tsearch.3, wcpcpy.3, wcpncpy.3, wcrtomb.3, wcscat.3, wcscpy.3, wcslen.3, wcsncat.3, wcsncmp.3, wcsncpy.3, wcsnlen.3, wcsnrtombs.3, wcsrtombs.3, wcsstr.3, wcstok.3, wcstombs.3, wcwidth.3, wprintf.3, console_codes.4, dsp56k.4, full.4, initrd.4, loop.4, vcs.4, charmap.5, core.5, elf.5, locale.5, proc.5, repertoiremap.5, sysfs.5, termcap.5, aio.7, bpf-helpers.7, cgroups.7, charsets.7, complex.7, fanotify.7, feature_test_macros.7, inotify.7, locale.7, man-pages.7, man.7, pkeys.7, pthreads.7, rtld-audit.7, sock_diag.7, unix.7, user_namespaces.7, utf-8.7: Use '\e' rather than '\\' to get a backslash
Quoting Branden:

*roff escape sequences may sometimes look like C escapes, but that
is misleading.  *roff is in part a macro language and that means
recursive expansion to arbitrary depths.

You can get away with "\\" in a context where no macro expansion
is taking place, but try to spell a literal backslash this way in
the argument to a macro and you will likely be unhappy with
results.

Try viewing the attached file with "man -l".

"\e" is the preferred and portable way to get a portable "escape
literal" going back to CSTR #54, the original Bell Labs troff
paper.

groff(7) discusses the issue:

  \\     reduces to a single backslash; useful to delay its
         interpretation as escape character in copy mode.  For a
         printable backslash, use \e, or even better \[rs], to be
         independent from the current escape character.

As of groff 1.22.4, groff_man(7) does as well:

  \e     Widely used in man pages to represent a backslash output
         glyph.  It works reliably as long as the .ec request is
         not used, which should never happen in man pages, and it
         is slightly more portable than the more exact ‘\(rs’
         (“reverse solidus”) escape sequence.

People not concerned with portability to extremely old troffs should
probably just use \(rs (or \[rs]), as it means "the backslash
glyph", not "the glyph corresponding to whatever the current escape
character is".

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-27 15:32:50 +01:00
Michael Kerrisk 8fb01fdeac adjtimex.2, futex.2, mremap.2, seccomp.2, getnameinfo.3, random.3, console_codes.4, sysfs.5, sched.7, unicode.7: Use zero‐width space in appropriate locations
Quoting Branden:

    *roff systems will interpret the period in the unpatched
    page as sentence-ending punctuation and put inter-sentence
    spacing after it.  (This might not be visible on
    nroff/terminal devices, but it is more likely to be on
    typesetter/PostScript/PDF output).

    groff_man(7) in groff 1.22.4 attempts to throw man page
    writers a bone here:

     \&     Zero‐width space.  Append to an input line to prevent
            an end‐of‐ sentence punctuation sequence from being
            recognized as such, or insert at the beginning of an
            input line to prevent a dot or apostrophe from being
            interpreted as the beginning of a roff request.

Reported-by: Bjarni Ingi Gislason <bjarniig@rhi.hi.is>
Reported-by: G. Branden Robinson <g.branden.robinson@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-27 15:32:41 +01:00
Michael Kerrisk d8012462d7 fallocate.2, futex.2, getrandom.2, mprotect.2, posix_spawn.3, address_families.7, ipv6.7, sock_diag.7, socket.7: ffix
Reported-by: Bjarni Ingi Gislason <bjarniig@rhi.hi.is>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-27 10:31:55 +01:00
Michael Kerrisk 44449eb99f locale.7, user_namespaces.7: ffix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-27 10:25:56 +01:00
Michael Kerrisk f711139679 epoll_ctl.2, ioctl_userfaultfd.2, keyctl.2, ptrace.2, socket.7: ffix
Reported-by: Bjarni Ingi Gislason <bjarniig@rhi.hi.is>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-27 10:06:04 +01:00
nixiaoming ebfb6feee6 fanotify_init.2, fanotify.7: Document FAN_REPORT_TID
fanotify_init.2: add new flag FAN_REPORT_TID
fanotify.7: update description of member pid in
    struct fanotify_event_metadata

Signed-off-by: nixiaoming <nixiaoming@huawei.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:39:00 +01:00
Michael Kerrisk 953d1e0792 fanotify_mark.2, fanotify.7: Minor tweaks to Amir Goldstein's patch
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:39:00 +01:00
Amir Goldstein b2f8214d47 fanotify_mark.2, fanotify.7: Document FAN_MARK_FILESYSTEM
Monitor fanotify events on the entire filesystem.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:39:00 +01:00
Michael Kerrisk fd1eb8a782 fanotify_mark.2, fanotify.7: Minor tweaks to Matthew Bobrowski's patch
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:39:00 +01:00
Matthew Bobrowski fc37d2f1c8 fanotify_mark.2, fanotify.7: Document FAN_OPEN_EXEC and FAN_OPEN_EXEC_PERM
New event masks have been added to the fanotify API. Documentation to
support the use and behaviour of these new masks has been added
accordingly.

Signed-off-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:39:00 +01:00
Michael Kerrisk 5ef4a59dbf inotify.7: Minor tweaks
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:39:00 +01:00
Michael Kerrisk 859758b692 inotify.7: Minor fixes to Henry Wilson's patch
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:38:56 +01:00
Henry Wilson 381b7a9111 inotify.7: Document IN_MASK_CREATE
Add documentation for new flag IN_MASK_CREATE for inotify_add_watch()
which is used to only allow new watches to be created.

Information obtained from a patch I submitted to the linux kernel
https://marc.info/?l=linux-fsdevel&m=152775980422847&w=2

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:38:25 +01:00
Michael Kerrisk 29fa4cbc2e cgroups.7: Document the use of 'cgroup_no_v1=named' to disable v1 named hierarchies
This feature was added in Linux 5.0.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-26 17:38:19 +01:00
Eugene Syromyatnikov 5dfd2983f7 address_families.7: tfix
Signed-off-by: Eugene Syromyatnikov <evgsyr@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 11:13:37 +01:00
Eugene Syromyatnikov 22570de1e1 socket.2, address_families.7: Mention that address family names are Linux-specific
* man2/socket.2 (.SH DESCRIPTION): Mention that the list of
  address families is Linux-specific.
* man7/address_families.7 (.SH DESCRIPTION): Likewise.

Signed-off-by: Eugene Syromyatnikov <evgsyr@gmail.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 11:07:52 +01:00
bert hubert 2ca483cd4b ip.7: IP_RECVTTL error fixed
I need to get the TTL of UDP datagrams from userspace, so I set
the IP_RECVTTL socket option.  And as promised by ip.7, I then get
IP_TTL messages from recvfrom.  However, unlike what the manpage
promises, the TTL field gets passed as a 32 bit integer.

The following userspace code works:

  uint32_t ttl32;
  for (cmsg = CMSG_FIRSTHDR(msgh); cmsg != NULL; cmsg = CMSG_NXTHDR(msgh,cmsg)) {
    if ((cmsg->cmsg_level == IPPROTO_IP) && (cmsg->cmsg_type == IP_TTL) &&
        CMSG_LEN(sizeof(ttl32)) == cmsg->cmsg_len) {

      memcpy(&ttl32, CMSG_DATA(cmsg), sizeof(ttl32));
      *ttl=ttl32;
      return true;
    }
    else
      cerr<<"Saw something else "<<(cmsg->cmsg_type == IP_TTL) <<
		", "<<(int)cmsg->cmsg_level<<", "<<cmsg->cmsg_len<<", "<<
		CMSG_LEN(1)<<endl;
  }

The 'else' field was used to figure out I go the length wrong.

Note from mtk:

Reading the source code also seems to confirm this, from
net/ipv4/ip_sockglue.c:

[[
static void ip_cmsg_recv_ttl(struct msghdr *msg, struct sk_buff *skb)
{
        int ttl = ip_hdr(skb)->ttl;
        put_cmsg(msg, SOL_IP, IP_TTL, sizeof(int), &ttl);
}
]]

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-25 10:49:09 +01:00
Michael Kerrisk 9f92e4e1cb capabilities.7: tfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 4312e0cb67 capabilities.7: CAP_SYS_CHROOT allows use of setns() to change the mount namespace
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk dd61e8a8f4 capabilities.7: srcfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 9c5b11bf42 capabilities.7: Add a subsection on per-user-namespace "set-user-ID-root" programs
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk bcf7072dbd capabilities.7: Relocate the subsection "Interaction with user namespaces"
This best belongs at the end of the page, after the subsections
that already make some mention of user namespaces.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 049d1a1534 capabilities.7: wfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 33d0916f81 capabilities.7: Substantially rework "Capabilities and execution of programs by root"
Rework for improved clarity, and also to include missing details
on the case where (1) the binary that is being executed has
capabilities attached and (2) the real user ID of the process is
not 0 (root) and (3) the effective user ID of the process is 0
(root).

Kernel code analysis and some test code (GPLv3 licensed) below.

======

My analysis of security/commoncaps.c capabilities handling
(from Linux 4.20 source):

execve() eventually calls __do_execve_file():

__do_execve_file()
  |
  +-prepare_bprm_creds(&bprm)
  |  |
  |  +-prepare_exec_creds()
  |  |  |
  |  |  +-prepare_creds()
  |  |     |
  |  |     | // Returns copy of existing creds
  |  |     |
  |  |     +-security_prepare_creds()
  |  |        |
  |  |        +-cred_prepare() [via hook]
  |  |           // Seems to do nothing for commoncaps
  |  |
  |  // Returns creds provided by prepare_creds()
  |
  // Places creds returned by prepare_exec_creds() in bprm->creds
  |
  |
  +-prepare_binprm(&bprm) // bprm from prepare_bprm_creds()
     |
     +-bprm_fill_uid(&bprm)
     |
     |  // Places current credentials into bprm
     |
     |  // Performs set-UID & set-GID transitions if those file bits are set
     |
     +-security_bprm_set_creds(&bprm)
        |
        +-bprm_set_creds(&bprm) [via hook]
           |
           +-cap_bprm_set_creds(&bprm)
              |
              // effective = false
              |
              +-get_file_caps(&bprm, &effective, &has_fcap)
              |  |
              |  +-get_vfs_caps_from_disk(..., &vcaps)
              |  |
              |  |  // Fetches file capabilities from disk and places in vcaps
              |  |
              |  +-bprm_caps_from_vfs_caps(&vcaps, &bprm, &effective, &has_fcap)
              |
              |     // If file effective bit is set: effective = true
              |     //
              |     // If file has capabilities: has_fcap |= true
              |     //
              |     // Perform execve transformation:
              |     //     P'(perm) = F(inh) & P(Inh) | F(Perm) & P(bset)
              |
              +-handle_privileged_root(&bprm, has_fcap, &effective, root_uid)
              |
              |  // If has_fcap && (rUID != root && eUID == root) then
              |  //     return without doing anything
              |  //
              |  // If rUID == root || eUID == root then
              |  //    P'(perm) = P(inh) | P(bset)
              |  //
              |  // If eUID == root then
              |  //     effective = true
              |
              // Perform execve() transformation:
              //
              //     P'(Amb) = (privprog) ? 0 : P(Amb)
              //     P'(Perm) |= P'(Amb)
              //     P'(Eff) = effective ? P'(Perm) : P'(Amb)

Summary

1. Perform set-UID/set-GID transformations

2. P'(Amb) = (privprog) ? 0 : P(Amb)

3. If [process has nonzero UIDs] OR
   ([file has caps] && [rUID != root && eUID == root]), then

        P'(perm) = F(inh) & P(Inh) | F(Perm) & P(bset) | P'(Amb)

   else // ~ [process has rUID == root || eUID == root]

        P'(perm) = P(inh) | P(bset) | P'(Amb)

4. P'(Eff) = (F(eff) || eUID == root) ? P'(Perm) : P'(Amb)

======

$ cat show_creds_and_caps_long.c

int
main(int argc, char *argv[])
{
    uid_t ruid, euid, suid;
    gid_t rgid, egid, sgid;
    cap_t caps;
    char *s;

    if (getresuid(&ruid, &euid, &suid) == -1) {
        perror("getresuid");
        exit(EXIT_FAILURE);
    }

    if (getresgid(&rgid, &egid, &sgid) == -1) {
        perror("getresgid");
        exit(EXIT_FAILURE);
    }

    printf("UID: %5ld (real), %5ld (effective), %5ld (saved)\n",
            (long) ruid, (long) euid, (long) suid);
    printf("GID: %5ld (real), %5ld (effective), %5ld (saved)\n",
            (long) rgid, (long) egid, (long) sgid);

    caps = cap_get_proc();
    if (caps == NULL) {
        perror("cap_get_proc");
        exit(EXIT_FAILURE);
    }
    s = cap_to_text(caps, NULL);
    if (s == NULL) {
        perror("cap_to_text");
        exit(EXIT_FAILURE);
    }
    printf("Capabilities: %s\n", s);

    cap_free(caps);
    cap_free(s);

    exit(EXIT_SUCCESS);
}

$ cat cred_launcher.c

                        } while (0)

                        do { fprintf(stderr, "Usage: "); \
                             fprintf(stderr, msg, progName); \
                             exit(EXIT_FAILURE); } while (0)

int
main(int argc, char *argv[])
{
    uid_t r, e, s;

    if (argc != 5 || strcmp(argv[1], "--help") == 0)
        usageErr("%s rUID eUID sUID <prog>\n", argv[0]);

    r = atoi(argv[1]);
    e = atoi(argv[2]);
    s = atoi(argv[3]);

    if (setresuid(r, e, s) == -1)
        errExit("setresuid");

    if (getresuid(&r, &e, &s) == -1)
        errExit("getresuid");

    execv(argv[4], &argv[4]);
    errExit("execve");
}

$ cc -o cred_launcher cred_launcher.c
$ cc -o show_creds_and_caps_long show_creds_and_caps_long.c -lcap

$ sudo ./cred_launcher 1000 0 1000 ./show_creds_and_caps_long
UID:  1000 (real),     0 (effective),     0 (saved)
GID:     0 (real),     0 (effective),     0 (saved)
Capabilities: =ep

$ sudo setcap cap_kill=pe show_creds_and_caps_long
$ sudo ./cred_launcher 1000 0 1000 ./show_creds_and_caps_long
UID:  1000 (real),     0 (effective),     0 (saved)
GID:     0 (real),     0 (effective),     0 (saved)
Capabilities: = cap_kill+ep

The final program execution above shows the special casing
that occurs in handle_privileged_root() for the case where:

    rUID != root && eUID == root && [file has capabilities]

======

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk cc0fb214da capabilities.7: tfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk 1a9ed17c9e capabilities.7: Improve the discussion of when file capabilities are ignored
The text stated that the execve() capability transitions are not
performed for the same reasons that setuid and setgid mode bits
may be ignored (as described in execve(2)). But, that's not quite
correct: rather, the file capability sets are treated as empty
for the purpose of the capability transition calculations.

Also merge the new 'no_file_caps' kernel option text into the
same paragraph.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk f6acfeb8f8 capabilities.7: Document the 'no_file_caps' kernel command-line option
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-23 22:03:20 +01:00
Michael Kerrisk bc1950ac92 capabilities.7: Rework discussion of exec and UID 0, correcting a couple of details
Clarify the "Capabilities and execution of programs by root"
section, and correct a couple of details:

* If a process with rUID == 0 && eUID != 0 does an exec,
  the process will nevertheless gain effective capabilities
  if the file effective bit is set.
* Set-UID-root programs only confer a full set of capabilities
  if the binary does not also have attached capabilities.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-10 03:40:15 +01:00
Michael Kerrisk db18d67f21 capabilities.7: srcfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-07 11:40:25 +01:00
Michael Kerrisk 1873715c21 namespaces.7: srcfix
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
2019-02-07 02:07:28 +01:00