357 lines
9.3 KiB
HTML
357 lines
9.3 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of SETPRIV</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>SETPRIV</H1>
|
|
Section: User Commands (1)<BR>Updated: July 2014<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
setpriv - run a program with different Linux privilege settings
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>setpriv</B>
|
|
|
|
[options]
|
|
<I>program</I>
|
|
|
|
[<I>arguments</I>]
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
Sets or queries various Linux privilege settings that are inherited across
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<P>
|
|
|
|
In comparison to
|
|
<B><A HREF="/cgi-bin/man/man2html?1+su">su</A></B>(1)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?1+runuser">runuser</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+setpriv">setpriv</A></B>(1)
|
|
|
|
neither uses PAM, nor does it prompt for a password.
|
|
It is a simple, non-set-user-ID wrapper around
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
and can be used to drop privileges in the same way as
|
|
<B><A HREF="/cgi-bin/man/man2html?8+setuidgid">setuidgid</A></B>(8)
|
|
|
|
from
|
|
<B>daemontools</B>,
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+chpst">chpst</A></B>(8)
|
|
|
|
from
|
|
<B>runit</B>,
|
|
|
|
or similar tools shipped by other service managers.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTION</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>--clear-groups</B>
|
|
|
|
<DD>
|
|
Clear supplementary groups.
|
|
<DT id="2"><B>-d</B>,<B> --dump</B>
|
|
|
|
<DD>
|
|
Dump current privilege state. Can be specified more than once to show extra,
|
|
mostly useless, information. Incompatible with all other options.
|
|
<DT id="3"><B>--groups </B><I>group</I>...
|
|
|
|
<DD>
|
|
Set supplementary groups. The argument is a comma-separated list of GIDs or names.
|
|
<DT id="4"><B>--inh-caps</B> (<B>+</B>|<B>-</B>)<B></B><I>cap</I>... or <B>--ambient-caps</B> (<B>+</B>|<B>-</B>)<B></B><I>cap</I>... or <B>--bounding-set</B> (<B>+</B>|<B>-</B>)<B></B><I>cap</I>...
|
|
|
|
<DD>
|
|
Set the inheritable capabilities, ambient capabilities or the capability bounding set. See
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7).
|
|
|
|
The argument is a comma-separated list of
|
|
<B>+</B><I>cap</I>
|
|
|
|
and
|
|
<B>-</B><I>cap</I>
|
|
|
|
entries, which add or remove an entry respectively. <I>cap</I> can either be a
|
|
human-readable name as seen in
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7)
|
|
|
|
without the <I>cap_</I> prefix or of the format
|
|
<B>cap_N</B><I>,</I>
|
|
|
|
where <I>N</I> is the internal capability index used by Linux.
|
|
<B>+all</B>
|
|
|
|
and
|
|
<B>-all</B>
|
|
|
|
can be used to add or remove all caps. The set of capabilities starts out as
|
|
the current inheritable set for
|
|
<B>--inh-caps</B>,
|
|
|
|
the current ambient set for
|
|
<B>--ambient-caps</B>
|
|
|
|
and the current bounding set for
|
|
<B>--bounding-set</B>.
|
|
|
|
If you drop something from the bounding set without also dropping it from the
|
|
inheritable set, you are likely to become confused. Do not do that.
|
|
<DT id="5"><B>--keep-groups</B>
|
|
|
|
<DD>
|
|
Preserve supplementary groups. Only useful in conjunction with
|
|
<B>--rgid</B>,
|
|
|
|
<B>--egid</B>, or
|
|
|
|
<B>--regid</B>.
|
|
|
|
<DT id="6"><B>--init-groups</B>
|
|
|
|
<DD>
|
|
Initialize supplementary groups using
|
|
<B><A HREF="/cgi-bin/man/man2html?3+initgroups">initgroups</A></B>(3).
|
|
|
|
Only useful in conjunction with
|
|
<B>--ruid</B>
|
|
|
|
or
|
|
<B>--reuid</B>.
|
|
|
|
<DT id="7"><B>--list-caps</B>
|
|
|
|
<DD>
|
|
List all known capabilities. This option must be specified alone.
|
|
<DT id="8"><B>--no-new-privs</B>
|
|
|
|
<DD>
|
|
Set the
|
|
<I>no_new_privs</I>
|
|
|
|
bit. With this bit set,
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
will not grant new privileges.
|
|
For example, the set-user-ID and set-group-ID bits as well
|
|
as file capabilities will be disabled. (Executing binaries with these bits set
|
|
will still work, but they will not gain privileges. Certain LSMs, especially
|
|
AppArmor, may result in failures to execute certain programs.) This bit is
|
|
inherited by child processes and cannot be unset. See
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2)
|
|
|
|
and
|
|
<I>Documentation/:prctl/:no_:new_:privs.txt</I>
|
|
|
|
in the Linux kernel source.
|
|
<P>
|
|
The no_new_privs bit is supported since Linux 3.5.
|
|
<DT id="9"><B>--rgid</B><I> gid</I>, <B>--egid</B><I> gid</I>, <B>--regid</B><I> gid</I>
|
|
|
|
<DD>
|
|
Set the real, effective, or both GIDs. The <I>gid</I> argument can be
|
|
given as textual group name.
|
|
<P>
|
|
For safety, you must specify one of
|
|
<B>--clear-groups</B>,
|
|
|
|
<B>--groups</B>,
|
|
|
|
<B>--keep-groups</B>, or
|
|
|
|
<B>--init-groups</B>
|
|
|
|
if you set any primary
|
|
<I>gid</I>.
|
|
|
|
<DT id="10"><B>--ruid</B><I> uid</I>, <B>--euid</B><I> uid</I>, <B>--reuid</B><I> uid</I>
|
|
|
|
<DD>
|
|
Set the real, effective, or both UIDs. The <I>uid</I> argument can be
|
|
given as textual login name.
|
|
<P>
|
|
Setting a
|
|
<I>uid</I>
|
|
|
|
or
|
|
<I>gid</I>
|
|
|
|
does not change capabilities, although the exec call at the end might change
|
|
capabilities. This means that, if you are root, you probably want to do
|
|
something like:
|
|
<P>
|
|
<B> setpriv --reuid=1000 --regid=1000 --inh-caps=-all</B>
|
|
|
|
<DT id="11"><B>--securebits</B> (<B>+</B>|<B>-</B>)<B></B><I>securebit</I>...
|
|
|
|
<DD>
|
|
Set or clear securebits. The argument is a comma-separated list.
|
|
The valid securebits are
|
|
<I>noroot</I>,
|
|
|
|
<I>noroot_locked</I>,
|
|
|
|
<I>no_setuid_fixup</I>,
|
|
|
|
<I>no_setuid_fixup_locked</I>,
|
|
|
|
and
|
|
<I>keep_caps_locked</I>.
|
|
|
|
<I>keep_caps</I>
|
|
|
|
is cleared by
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
and is therefore not allowed.
|
|
<DT id="12"><B>--pdeathsig keep</B>|<B>clear</B>|<B><signal></B>
|
|
|
|
<DD>
|
|
Keep, clear or set the parent death signal. Some LSMs, most notably SELinux and
|
|
AppArmor, clear the signal when the process' credentials change. Using
|
|
<B>--pdeathsig keep</B> will restore the parent death signal after changing
|
|
credentials to remedy that situation.
|
|
<DT id="13"><B>--selinux-label</B><I> label</I>
|
|
|
|
<DD>
|
|
Request a particular SELinux transition (using a transition on exec, not
|
|
dyntrans). This will fail and cause
|
|
<B><A HREF="/cgi-bin/man/man2html?1+setpriv">setpriv</A></B>(1)
|
|
|
|
to abort if SELinux is not in use, and the transition may be ignored or cause
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
to fail at SELinux's whim. (In particular, this is unlikely to work in
|
|
conjunction with
|
|
<I>no_new_privs</I>.)
|
|
|
|
This is similar to
|
|
<B><A HREF="/cgi-bin/man/man2html?1+runcon">runcon</A></B>(1).
|
|
|
|
<DT id="14"><B>--apparmor-profile</B><I> profile</I>
|
|
|
|
<DD>
|
|
Request a particular AppArmor profile (using a transition on exec). This will
|
|
fail and cause
|
|
<B><A HREF="/cgi-bin/man/man2html?1+setpriv">setpriv</A></B>(1)
|
|
|
|
to abort if AppArmor is not in use, and the transition may be ignored or cause
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
to fail at AppArmor's whim.
|
|
<DT id="15"><B>--reset-env</B>
|
|
|
|
<DD>
|
|
Clears all the environment variables except TERM; initializes the environment variables HOME, SHELL, USER, LOGNAME
|
|
according to the user's passwd entry; sets PATH to <I>/usr/local/bin:/bin:/usr/bin</I> for a regual user and to
|
|
<I>/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin</I> for root.
|
|
<P>
|
|
The environment variable PATH may be different on systems where /bin and /sbin
|
|
are merged into /usr. The environment variable SHELL defaults to <I>/bin/sh</I> if none is given in the user's
|
|
passwd entry.
|
|
<DT id="16"><B>-V</B>,<B> --version</B>
|
|
|
|
<DD>
|
|
Display version information and exit.
|
|
<DT id="17"><B>-h</B>,<B> --help</B>
|
|
|
|
<DD>
|
|
Display help text and exit.
|
|
</DL>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
If applying any specified option fails,
|
|
<I>program</I>
|
|
|
|
will not be run and
|
|
<B>setpriv</B>
|
|
|
|
will return with exit code 127.
|
|
<P>
|
|
|
|
Be careful with this tool -- it may have unexpected security consequences.
|
|
For example, setting no_new_privs and then execing a program that is
|
|
SELinux-confined (as this tool would do) may prevent the SELinux
|
|
restrictions from taking effect.
|
|
<A NAME="lbAG"> </A>
|
|
<H2>EXAMPLE</H2>
|
|
|
|
If you're looking for behaviour similar to
|
|
<B><A HREF="/cgi-bin/man/man2html?1+su">su</A></B>(1)/<B><A HREF="/cgi-bin/man/man2html?1+runuser">runuser</A></B>(1), or <B><A HREF="/cgi-bin/man/man2html?8+sudo">sudo</A></B>(8)
|
|
|
|
(without the
|
|
<B>-g</B>
|
|
|
|
option), try something like:
|
|
<P>
|
|
<B> setpriv --reuid=1000 --regid=1000 --init-groups</B>
|
|
|
|
<P>
|
|
|
|
If you want to mimic daemontools'
|
|
<B><A HREF="/cgi-bin/man/man2html?8+setuid">setuid</A></B>(8),
|
|
|
|
try:
|
|
<P>
|
|
<B> setpriv --reuid=1000 --regid=1000 --clear-groups</B>
|
|
|
|
<A NAME="lbAH"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+runuser">runuser</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+su">su</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7)
|
|
|
|
<A NAME="lbAI"> </A>
|
|
<H2>AUTHOR</H2>
|
|
|
|
|
|
Andy Lutomirski
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>AVAILABILITY</H2>
|
|
|
|
The
|
|
<B>setpriv</B>
|
|
|
|
command is part of the util-linux package and is available from
|
|
|
|
Linux Kernel Archive
|
|
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="18"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="19"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="20"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="21"><A HREF="#lbAE">OPTION</A><DD>
|
|
<DT id="22"><A HREF="#lbAF">NOTES</A><DD>
|
|
<DT id="23"><A HREF="#lbAG">EXAMPLE</A><DD>
|
|
<DT id="24"><A HREF="#lbAH">SEE ALSO</A><DD>
|
|
<DT id="25"><A HREF="#lbAI">AUTHOR</A><DD>
|
|
<DT id="26"><A HREF="#lbAJ">AVAILABILITY</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:27 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|