2454 lines
54 KiB
HTML
2454 lines
54 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of PRCTL</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>PRCTL</H1>
|
|
Section: Linux Programmer's Manual (2)<BR>Updated: 2019-08-02<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
prctl - operations on a process
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<PRE>
|
|
<B>#include <<A HREF="file:///usr/include/sys/prctl.h">sys/prctl.h</A>></B>
|
|
|
|
<B>int prctl(int </B><I>option</I><B>, unsigned long </B><I>arg2</I><B>, unsigned long </B><I>arg3</I><B>,</B>
|
|
<B> unsigned long </B><I>arg4</I><B>, unsigned long </B><I>arg5</I><B>);</B>
|
|
</PRE>
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>prctl</B>()
|
|
|
|
is called with a first argument describing what to do
|
|
(with values defined in <I><<A HREF="file:///usr/include/linux/prctl.h">linux/prctl.h</A>></I>), and further
|
|
arguments with a significance depending on the first one.
|
|
The first argument can be:
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>PR_CAP_AMBIENT</B> (since Linux 4.3)
|
|
|
|
<DD>
|
|
|
|
Reads or changes the ambient capability set of the calling thread,
|
|
according to the value of
|
|
<I>arg2</I>,
|
|
|
|
which must be one of the following:
|
|
<DL COMPACT><DT id="2"><DD>
|
|
|
|
<DL COMPACT>
|
|
<DT id="3"><B>PR_CAP_AMBIENT_RAISE</B>
|
|
|
|
<DD>
|
|
The capability specified in
|
|
<I>arg3</I>
|
|
|
|
is added to the ambient set.
|
|
The specified capability must already be present in
|
|
both the permitted and the inheritable sets of the process.
|
|
This operation is not permitted if the
|
|
<B>SECBIT_NO_CAP_AMBIENT_RAISE</B>
|
|
|
|
securebit is set.
|
|
<DT id="4"><B>PR_CAP_AMBIENT_LOWER</B>
|
|
|
|
<DD>
|
|
The capability specified in
|
|
<I>arg3</I>
|
|
|
|
is removed from the ambient set.
|
|
<DT id="5"><B>PR_CAP_AMBIENT_IS_SET</B>
|
|
|
|
<DD>
|
|
The
|
|
<B>prctl</B>()
|
|
|
|
call returns 1 if the capability in
|
|
<I>arg3</I>
|
|
|
|
is in the ambient set and 0 if it is not.
|
|
<DT id="6"><B>PR_CAP_AMBIENT_CLEAR_ALL</B>
|
|
|
|
<DD>
|
|
All capabilities will be removed from the ambient set.
|
|
This operation requires setting
|
|
<I>arg3</I>
|
|
|
|
to zero.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="7"><DD>
|
|
In all of the above operations,
|
|
<I>arg4</I>
|
|
|
|
and
|
|
<I>arg5</I>
|
|
|
|
must be specified as 0.
|
|
<DT id="8"><DD>
|
|
Higher-level interfaces layered on top of the above operations are
|
|
provided in the
|
|
<B><A HREF="/cgi-bin/man/man2html?3+libcap">libcap</A></B>(3)
|
|
|
|
library in the form of
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_get_ambient">cap_get_ambient</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_set_ambient">cap_set_ambient</A></B>(3),
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_reset_ambient">cap_reset_ambient</A></B>(3).
|
|
|
|
<DT id="9"><B>PR_CAPBSET_READ</B> (since Linux 2.6.25)
|
|
|
|
<DD>
|
|
Return (as the function result) 1 if the capability specified in
|
|
<I>arg2</I>
|
|
|
|
is in the calling thread's capability bounding set,
|
|
or 0 if it is not.
|
|
(The capability constants are defined in
|
|
<I><<A HREF="file:///usr/include/linux/capability.h">linux/capability.h</A>></I>.)
|
|
|
|
The capability bounding set dictates
|
|
whether the process can receive the capability through a
|
|
file's permitted capability set on a subsequent call to
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="10"><DD>
|
|
If the capability specified in
|
|
<I>arg2</I>
|
|
|
|
is not valid, then the call fails with the error
|
|
<B>EINVAL</B>.
|
|
|
|
<DT id="11"><DD>
|
|
A higher-level interface layered on top of this operation is provided in the
|
|
<B><A HREF="/cgi-bin/man/man2html?3+libcap">libcap</A></B>(3)
|
|
|
|
library in the form of
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_get_bound">cap_get_bound</A></B>(3).
|
|
|
|
<DT id="12"><B>PR_CAPBSET_DROP</B> (since Linux 2.6.25)
|
|
|
|
<DD>
|
|
If the calling thread has the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability within its user namespace, then drop the capability specified by
|
|
<I>arg2</I>
|
|
|
|
from the calling thread's capability bounding set.
|
|
Any children of the calling thread will inherit the newly
|
|
reduced bounding set.
|
|
<DT id="13"><DD>
|
|
The call fails with the error:
|
|
<B>EPERM</B>
|
|
|
|
if the calling thread does not have the
|
|
<B>CAP_SETPCAP</B>;
|
|
|
|
<B>EINVAL</B>
|
|
|
|
if
|
|
<I>arg2</I>
|
|
|
|
does not represent a valid capability; or
|
|
<B>EINVAL</B>
|
|
|
|
if file capabilities are not enabled in the kernel,
|
|
in which case bounding sets are not supported.
|
|
<DT id="14"><DD>
|
|
A higher-level interface layered on top of this operation is provided in the
|
|
<B><A HREF="/cgi-bin/man/man2html?3+libcap">libcap</A></B>(3)
|
|
|
|
library in the form of
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_drop_bound">cap_drop_bound</A></B>(3).
|
|
|
|
<DT id="15"><B>PR_SET_CHILD_SUBREAPER</B> (since Linux 3.4)
|
|
|
|
<DD>
|
|
|
|
If
|
|
<I>arg2</I>
|
|
|
|
is nonzero,
|
|
set the "child subreaper" attribute of the calling process;
|
|
if
|
|
<I>arg2</I>
|
|
|
|
is zero, unset the attribute.
|
|
<DT id="16"><DD>
|
|
A subreaper fulfills the role of
|
|
<B><A HREF="/cgi-bin/man/man2html?1+init">init</A></B>(1)
|
|
|
|
for its descendant processes.
|
|
When a process becomes orphaned
|
|
(i.e., its immediate parent terminates),
|
|
then that process will be reparented to
|
|
the nearest still living ancestor subreaper.
|
|
Subsequently, calls to
|
|
<B>getppid</B>()
|
|
|
|
in the orphaned process will now return the PID of the subreaper process,
|
|
and when the orphan terminates, it is the subreaper process that
|
|
will receive a
|
|
<B>SIGCHLD</B>
|
|
|
|
signal and will be able to
|
|
<B><A HREF="/cgi-bin/man/man2html?2+wait">wait</A></B>(2)
|
|
|
|
on the process to discover its termination status.
|
|
<DT id="17"><DD>
|
|
The setting of the "child subreaper" attribute
|
|
is not inherited by children created by
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+clone">clone</A></B>(2).
|
|
|
|
The setting is preserved across
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="18"><DD>
|
|
Establishing a subreaper process is useful in session management frameworks
|
|
where a hierarchical group of processes is managed by a subreaper process
|
|
that needs to be informed when one of the processes---for example,
|
|
a double-forked daemon---terminates
|
|
(perhaps so that it can restart that process).
|
|
Some
|
|
<B><A HREF="/cgi-bin/man/man2html?1+init">init</A></B>(1)
|
|
|
|
frameworks (e.g.,
|
|
<B><A HREF="/cgi-bin/man/man2html?1+systemd">systemd</A></B>(1))
|
|
|
|
employ a subreaper process for similar reasons.
|
|
<DT id="19"><B>PR_GET_CHILD_SUBREAPER</B> (since Linux 3.4)
|
|
|
|
<DD>
|
|
Return the "child subreaper" setting of the caller,
|
|
in the location pointed to by
|
|
<I>(int *) arg2</I>.
|
|
|
|
<DT id="20"><B>PR_SET_DUMPABLE</B> (since Linux 2.3.20)
|
|
|
|
<DD>
|
|
Set the state of the "dumpable" flag,
|
|
which determines whether core dumps are produced for the calling process
|
|
upon delivery of a signal whose default behavior is to produce a core dump.
|
|
<DT id="21"><DD>
|
|
In kernels up to and including 2.6.12,
|
|
<I>arg2</I>
|
|
|
|
must be either 0
|
|
(<B>SUID_DUMP_DISABLE</B>,
|
|
|
|
process is not dumpable) or 1
|
|
(<B>SUID_DUMP_USER</B>,
|
|
|
|
process is dumpable).
|
|
Between kernels 2.6.13 and 2.6.17,
|
|
|
|
the value 2 was also permitted,
|
|
which caused any binary which normally would not be dumped
|
|
to be dumped readable by root only;
|
|
for security reasons, this feature has been removed.
|
|
|
|
|
|
|
|
|
|
(See also the description of
|
|
<I>/proc/sys/fs/:suid_dumpable</I>
|
|
|
|
in
|
|
<B><A HREF="/cgi-bin/man/man2html?5+proc">proc</A></B>(5).)
|
|
|
|
<DT id="22"><DD>
|
|
Normally, this flag is set to 1.
|
|
However, it is reset to the current value contained in the file
|
|
<I>/proc/sys/fs/:suid_dumpable</I>
|
|
|
|
(which by default has the value 0),
|
|
in the following circumstances:
|
|
|
|
<DL COMPACT><DT id="23"><DD>
|
|
<DL COMPACT>
|
|
<DT id="24">*<DD>
|
|
The process's effective user or group ID is changed.
|
|
<DT id="25">*<DD>
|
|
The process's filesystem user or group ID is changed (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+credentials">credentials</A></B>(7)).
|
|
|
|
<DT id="26">*<DD>
|
|
The process executes
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2))
|
|
|
|
a set-user-ID or set-group-ID program, resulting in a change
|
|
of either the effective user ID or the effective group ID.
|
|
<DT id="27">*<DD>
|
|
The process executes
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2))
|
|
|
|
a program that has file capabilities (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7)),
|
|
|
|
|
|
but only if the permitted capabilities
|
|
gained exceed those already permitted for the process.
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="28"><DD>
|
|
Processes that are not dumpable can not be attached via
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ptrace">ptrace</A></B>(2)
|
|
|
|
<B>PTRACE_ATTACH</B>;
|
|
|
|
see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ptrace">ptrace</A></B>(2)
|
|
|
|
for further details.
|
|
<DT id="29"><DD>
|
|
If a process is not dumpable,
|
|
the ownership of files in the process's
|
|
<I>/proc/[pid]</I>
|
|
|
|
directory is affected as described in
|
|
<B><A HREF="/cgi-bin/man/man2html?5+proc">proc</A></B>(5).
|
|
|
|
<DT id="30"><B>PR_GET_DUMPABLE</B> (since Linux 2.3.20)
|
|
|
|
<DD>
|
|
Return (as the function result) the current state of the calling
|
|
process's dumpable flag.
|
|
|
|
|
|
|
|
<DT id="31"><B>PR_SET_ENDIAN</B> (since Linux 2.6.18, PowerPC only)
|
|
|
|
<DD>
|
|
Set the endian-ness of the calling process to the value given
|
|
in <I>arg2</I>, which should be one of the following:
|
|
|
|
<B>PR_ENDIAN_BIG</B>,
|
|
|
|
<B>PR_ENDIAN_LITTLE</B>,
|
|
|
|
or
|
|
<B>PR_ENDIAN_PPC_LITTLE</B>
|
|
|
|
(PowerPC pseudo little endian).
|
|
<DT id="32"><B>PR_GET_ENDIAN</B> (since Linux 2.6.18, PowerPC only)
|
|
|
|
<DD>
|
|
Return the endian-ness of the calling process,
|
|
in the location pointed to by
|
|
<I>(int *) arg2</I>.
|
|
|
|
<DT id="33"><B>PR_SET_FP_MODE</B> (since Linux 4.0, only on MIPS)
|
|
|
|
<DD>
|
|
|
|
On the MIPS architecture,
|
|
user-space code can be built using an ABI which permits linking
|
|
with code that has more restrictive floating-point (FP) requirements.
|
|
For example, user-space code may be built to target the O32 FPXX ABI
|
|
and linked with code built for either one of the more restrictive
|
|
FP32 or FP64 ABIs.
|
|
When more restrictive code is linked in,
|
|
the overall requirement for the process is to use the more
|
|
restrictive floating-point mode.
|
|
<DT id="34"><DD>
|
|
Because the kernel has no means of knowing in advance
|
|
which mode the process should be executed in,
|
|
and because these restrictions can
|
|
change over the lifetime of the process, the
|
|
<B>PR_SET_FP_MODE</B>
|
|
|
|
operation is provided to allow control of the floating-point mode
|
|
from user space.
|
|
<DT id="35"><DD>
|
|
|
|
The
|
|
<I>(unsigned int) arg2</I>
|
|
|
|
argument is a bit mask describing the floating-point mode used:
|
|
<DL COMPACT><DT id="36"><DD>
|
|
<DL COMPACT>
|
|
<DT id="37"><B>PR_FP_MODE_FR</B>
|
|
|
|
<DD>
|
|
When this bit is
|
|
<I>unset</I>
|
|
|
|
(so called
|
|
<B>FR=0</B> or <B>FR0</B>
|
|
|
|
mode), the 32 floating-point registers are 32 bits wide,
|
|
and 64-bit registers are represented as a pair of registers
|
|
(even- and odd- numbered,
|
|
with the even-numbered register containing the lower 32 bits,
|
|
and the odd-numbered register containing the higher 32 bits).
|
|
<DT id="38"><DD>
|
|
When this bit is
|
|
<I>set</I>
|
|
|
|
(on supported hardware),
|
|
the 32 floating-point registers are 64 bits wide (so called
|
|
<B>FR=1</B> or <B>FR1</B>
|
|
|
|
mode).
|
|
Note that modern MIPS implementations (MIPS R6 and newer) support
|
|
<B>FR=1</B>
|
|
|
|
mode only.
|
|
<DT id="39"><DD>
|
|
<DT id="40"><DD>
|
|
Applications that use the O32 FP32 ABI can operate only when this bit is
|
|
<I>unset</I>
|
|
|
|
(<B>FR=0</B>;
|
|
|
|
or they can be used with FRE enabled, see below).
|
|
Applications that use the O32 FP64 ABI
|
|
(and the O32 FP64A ABI, which exists to
|
|
provide the ability to operate with existing FP32 code; see below)
|
|
can operate only when this bit is
|
|
<I>set</I>
|
|
|
|
(<B>FR=1</B>).
|
|
|
|
Applications that use the O32 FPXX ABI can operate with either
|
|
<B>FR=0</B>
|
|
|
|
or
|
|
<B>FR=1</B>.
|
|
|
|
<DT id="41"><B>PR_FP_MODE_FRE</B>
|
|
|
|
<DD>
|
|
Enable emulation of 32-bit floating-point mode.
|
|
When this mode is enabled,
|
|
it emulates 32-bit floating-point operations
|
|
by raising a reserved-instruction exception
|
|
on every instruction that uses 32-bit formats and
|
|
the kernel then handles the instruction in software.
|
|
(The problem lies in the discrepancy of handling odd-numbered registers
|
|
which are the high 32 bits of 64-bit registers with even numbers in
|
|
<B>FR=0</B>
|
|
|
|
mode and the lower 32-bit parts of odd-numbered 64-bit registers in
|
|
<B>FR=1</B>
|
|
|
|
mode.)
|
|
Enabling this bit is necessary when code with the O32 FP32 ABI should operate
|
|
with code with compatible the O32 FPXX or O32 FP64A ABIs (which require
|
|
<B>FR=1</B>
|
|
|
|
FPU mode) or when it is executed on newer hardware (MIPS R6 onwards)
|
|
which lacks
|
|
<B>FR=0</B>
|
|
|
|
mode support when a binary with the FP32 ABI is used.
|
|
<DT id="42"><DD>
|
|
Note that this mode makes sense only when the FPU is in 64-bit mode
|
|
(<B>FR=1</B>).
|
|
|
|
<DT id="43"><DD>
|
|
Note that the use of emulation inherently has a significant performance hit
|
|
and should be avoided if possible.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="44"><DD>
|
|
In the N32/N64 ABI, 64-bit floating-point mode is always used,
|
|
so FPU emulation is not required and the FPU always operates in
|
|
<B>FR=1</B>
|
|
|
|
mode.
|
|
<DT id="45"><DD>
|
|
This option is mainly intended for use by the dynamic linker
|
|
(<B><A HREF="/cgi-bin/man/man2html?8+ld.so">ld.so</A></B>(8)).
|
|
|
|
<DT id="46"><DD>
|
|
The arguments
|
|
<I>arg3</I>,
|
|
|
|
<I>arg4</I>,
|
|
|
|
and
|
|
<I>arg5</I>
|
|
|
|
are ignored.
|
|
<DT id="47"><B>PR_GET_FP_MODE</B> (since Linux 4.0, only on MIPS)
|
|
|
|
<DD>
|
|
Return (as the function result)
|
|
the current floating-point mode (see the description of
|
|
<B>PR_SET_FP_MODE</B>
|
|
|
|
for details).
|
|
<DT id="48"><DD>
|
|
On success,
|
|
the call returns a bit mask which represents the current floating-point mode.
|
|
<DT id="49"><DD>
|
|
The arguments
|
|
<I>arg2</I>,
|
|
|
|
<I>arg3</I>,
|
|
|
|
<I>arg4</I>,
|
|
|
|
and
|
|
<I>arg5</I>
|
|
|
|
are ignored.
|
|
<DT id="50"><B>PR_SET_FPEMU</B> (since Linux 2.4.18, 2.5.9, only on ia64)
|
|
|
|
<DD>
|
|
Set floating-point emulation control bits to <I>arg2</I>.
|
|
Pass
|
|
<B>PR_FPEMU_NOPRINT</B>
|
|
|
|
to silently emulate floating-point operation accesses, or
|
|
<B>PR_FPEMU_SIGFPE</B>
|
|
|
|
to not emulate floating-point operations and send
|
|
<B>SIGFPE</B>
|
|
|
|
instead.
|
|
<DT id="51"><B>PR_GET_FPEMU</B> (since Linux 2.4.18, 2.5.9, only on ia64)
|
|
|
|
<DD>
|
|
Return floating-point emulation control bits,
|
|
in the location pointed to by
|
|
<I>(int *) arg2</I>.
|
|
|
|
<DT id="52"><B>PR_SET_FPEXC</B> (since Linux 2.4.21, 2.5.32, only on PowerPC)
|
|
|
|
<DD>
|
|
Set floating-point exception mode to <I>arg2</I>.
|
|
Pass <B>PR_FP_EXC_SW_ENABLE</B> to use FPEXC for FP exception enables,
|
|
<B>PR_FP_EXC_DIV</B> for floating-point divide by zero,
|
|
<B>PR_FP_EXC_OVF</B> for floating-point overflow,
|
|
<B>PR_FP_EXC_UND</B> for floating-point underflow,
|
|
<B>PR_FP_EXC_RES</B> for floating-point inexact result,
|
|
<B>PR_FP_EXC_INV</B> for floating-point invalid operation,
|
|
<B>PR_FP_EXC_DISABLED</B> for FP exceptions disabled,
|
|
<B>PR_FP_EXC_NONRECOV</B> for async nonrecoverable exception mode,
|
|
<B>PR_FP_EXC_ASYNC</B> for async recoverable exception mode,
|
|
<B>PR_FP_EXC_PRECISE</B> for precise exception mode.
|
|
<DT id="53"><B>PR_GET_FPEXC</B> (since Linux 2.4.21, 2.5.32, only on PowerPC)
|
|
|
|
<DD>
|
|
Return floating-point exception mode,
|
|
in the location pointed to by
|
|
<I>(int *) arg2</I>.
|
|
|
|
<DT id="54"><B>PR_SET_KEEPCAPS</B> (since Linux 2.2.18)
|
|
|
|
<DD>
|
|
Set the state of the calling thread's "keep capabilities" flag.
|
|
The effect of this flag is described in
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7).
|
|
|
|
<I>arg2</I>
|
|
|
|
must be either 0 (clear the flag)
|
|
or 1 (set the flag).
|
|
The "keep capabilities" value will be reset to 0 on subsequent calls to
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="55"><B>PR_GET_KEEPCAPS</B> (since Linux 2.2.18)
|
|
|
|
<DD>
|
|
Return (as the function result) the current state of the calling thread's
|
|
"keep capabilities" flag.
|
|
See
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7)
|
|
|
|
for a description of this flag.
|
|
<DT id="56"><B>PR_MCE_KILL</B> (since Linux 2.6.32)
|
|
|
|
<DD>
|
|
Set the machine check memory corruption kill policy for the calling thread.
|
|
If
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>PR_MCE_KILL_CLEAR</B>,
|
|
|
|
clear the thread memory corruption kill policy and use the system-wide default.
|
|
(The system-wide default is defined by
|
|
<I>/proc/sys/vm/memory_failure_early_kill</I>;
|
|
|
|
see
|
|
<B><A HREF="/cgi-bin/man/man2html?5+proc">proc</A></B>(5).)
|
|
|
|
If
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>PR_MCE_KILL_SET</B>,
|
|
|
|
use a thread-specific memory corruption kill policy.
|
|
In this case,
|
|
<I>arg3</I>
|
|
|
|
defines whether the policy is
|
|
<I>early kill</I>
|
|
|
|
(<B>PR_MCE_KILL_EARLY</B>),
|
|
|
|
<I>late kill</I>
|
|
|
|
(<B>PR_MCE_KILL_LATE</B>),
|
|
|
|
or the system-wide default
|
|
(<B>PR_MCE_KILL_DEFAULT</B>).
|
|
|
|
Early kill means that the thread receives a
|
|
<B>SIGBUS</B>
|
|
|
|
signal as soon as hardware memory corruption is detected inside
|
|
its address space.
|
|
In late kill mode, the process is killed only when it accesses a corrupted page.
|
|
See
|
|
<B><A HREF="/cgi-bin/man/man2html?2+sigaction">sigaction</A></B>(2)
|
|
|
|
for more information on the
|
|
<B>SIGBUS</B>
|
|
|
|
signal.
|
|
The policy is inherited by children.
|
|
The remaining unused
|
|
<B>prctl</B>()
|
|
|
|
arguments must be zero for future compatibility.
|
|
<DT id="57"><B>PR_MCE_KILL_GET</B> (since Linux 2.6.32)
|
|
|
|
<DD>
|
|
Return (as the function result)
|
|
the current per-process machine check kill policy.
|
|
All unused
|
|
<B>prctl</B>()
|
|
|
|
arguments must be zero.
|
|
<DT id="58"><B>PR_SET_MM</B> (since Linux 3.3)
|
|
|
|
<DD>
|
|
|
|
Modify certain kernel memory map descriptor fields
|
|
of the calling process.
|
|
Usually these fields are set by the kernel and dynamic loader (see
|
|
<B><A HREF="/cgi-bin/man/man2html?8+ld.so">ld.so</A></B>(8)
|
|
|
|
for more information) and a regular application should not use this feature.
|
|
However, there are cases, such as self-modifying programs,
|
|
where a program might find it useful to change its own memory map.
|
|
<DT id="59"><DD>
|
|
The calling process must have the
|
|
<B>CAP_SYS_RESOURCE</B>
|
|
|
|
capability.
|
|
The value in
|
|
<I>arg2</I>
|
|
|
|
is one of the options below, while
|
|
<I>arg3</I>
|
|
|
|
provides a new value for the option.
|
|
The
|
|
<I>arg4</I>
|
|
|
|
and
|
|
<I>arg5</I>
|
|
|
|
arguments must be zero if unused.
|
|
<DT id="60"><DD>
|
|
Before Linux 3.10,
|
|
|
|
this feature is available only if the kernel is built with the
|
|
<B>CONFIG_CHECKPOINT_RESTORE</B>
|
|
|
|
option enabled.
|
|
<DL COMPACT><DT id="61"><DD>
|
|
<DL COMPACT>
|
|
<DT id="62"><B>PR_SET_MM_START_CODE</B>
|
|
|
|
<DD>
|
|
Set the address above which the program text can run.
|
|
The corresponding memory area must be readable and executable,
|
|
but not writable or shareable (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mprotect">mprotect</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mmap">mmap</A></B>(2)
|
|
|
|
for more information).
|
|
<DT id="63"><B>PR_SET_MM_END_CODE</B>
|
|
|
|
<DD>
|
|
Set the address below which the program text can run.
|
|
The corresponding memory area must be readable and executable,
|
|
but not writable or shareable.
|
|
<DT id="64"><B>PR_SET_MM_START_DATA</B>
|
|
|
|
<DD>
|
|
Set the address above which initialized and
|
|
uninitialized (bss) data are placed.
|
|
The corresponding memory area must be readable and writable,
|
|
but not executable or shareable.
|
|
<DT id="65"><B>PR_SET_MM_END_DATA</B>
|
|
|
|
<DD>
|
|
Set the address below which initialized and
|
|
uninitialized (bss) data are placed.
|
|
The corresponding memory area must be readable and writable,
|
|
but not executable or shareable.
|
|
<DT id="66"><B>PR_SET_MM_START_STACK</B>
|
|
|
|
<DD>
|
|
Set the start address of the stack.
|
|
The corresponding memory area must be readable and writable.
|
|
<DT id="67"><B>PR_SET_MM_START_BRK</B>
|
|
|
|
<DD>
|
|
Set the address above which the program heap can be expanded with
|
|
<B><A HREF="/cgi-bin/man/man2html?2+brk">brk</A></B>(2)
|
|
|
|
call.
|
|
The address must be greater than the ending address of
|
|
the current program data segment.
|
|
In addition, the combined size of the resulting heap and
|
|
the size of the data segment can't exceed the
|
|
<B>RLIMIT_DATA</B>
|
|
|
|
resource limit (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setrlimit">setrlimit</A></B>(2)).
|
|
|
|
<DT id="68"><B>PR_SET_MM_BRK</B>
|
|
|
|
<DD>
|
|
Set the current
|
|
<B><A HREF="/cgi-bin/man/man2html?2+brk">brk</A></B>(2)
|
|
|
|
value.
|
|
The requirements for the address are the same as for the
|
|
<B>PR_SET_MM_START_BRK</B>
|
|
|
|
option.
|
|
</DL>
|
|
<P>
|
|
|
|
The following options are available since Linux 3.5.
|
|
|
|
<DL COMPACT>
|
|
<DT id="69"><B>PR_SET_MM_ARG_START</B>
|
|
|
|
<DD>
|
|
Set the address above which the program command line is placed.
|
|
<DT id="70"><B>PR_SET_MM_ARG_END</B>
|
|
|
|
<DD>
|
|
Set the address below which the program command line is placed.
|
|
<DT id="71"><B>PR_SET_MM_ENV_START</B>
|
|
|
|
<DD>
|
|
Set the address above which the program environment is placed.
|
|
<DT id="72"><B>PR_SET_MM_ENV_END</B>
|
|
|
|
<DD>
|
|
Set the address below which the program environment is placed.
|
|
<DT id="73"><DD>
|
|
The address passed with
|
|
<B>PR_SET_MM_ARG_START</B>,
|
|
|
|
<B>PR_SET_MM_ARG_END</B>,
|
|
|
|
<B>PR_SET_MM_ENV_START</B>,
|
|
|
|
and
|
|
<B>PR_SET_MM_ENV_END</B>
|
|
|
|
should belong to a process stack area.
|
|
Thus, the corresponding memory area must be readable, writable, and
|
|
(depending on the kernel configuration) have the
|
|
<B>MAP_GROWSDOWN</B>
|
|
|
|
attribute set (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mmap">mmap</A></B>(2)).
|
|
|
|
<DT id="74"><B>PR_SET_MM_AUXV</B>
|
|
|
|
<DD>
|
|
Set a new auxiliary vector.
|
|
The
|
|
<I>arg3</I>
|
|
|
|
argument should provide the address of the vector.
|
|
The
|
|
<I>arg4</I>
|
|
|
|
is the size of the vector.
|
|
<DT id="75"><B>PR_SET_MM_EXE_FILE</B>
|
|
|
|
<DD>
|
|
|
|
Supersede the
|
|
<I>/proc/pid/exe</I>
|
|
|
|
symbolic link with a new one pointing to a new executable file
|
|
identified by the file descriptor provided in
|
|
<I>arg3</I>
|
|
|
|
argument.
|
|
The file descriptor should be obtained with a regular
|
|
<B><A HREF="/cgi-bin/man/man2html?2+open">open</A></B>(2)
|
|
|
|
call.
|
|
<DT id="76"><DD>
|
|
To change the symbolic link, one needs to unmap all existing
|
|
executable memory areas, including those created by the kernel itself
|
|
(for example the kernel usually creates at least one executable
|
|
memory area for the ELF
|
|
<I>.text</I>
|
|
|
|
section).
|
|
<DT id="77"><DD>
|
|
In Linux 4.9 and earlier, the
|
|
|
|
<B>PR_SET_MM_EXE_FILE</B>
|
|
|
|
operation can be performed only once in a process's lifetime;
|
|
attempting to perform the operation a second time results in the error
|
|
<B>EPERM</B>.
|
|
|
|
This restriction was enforced for security reasons that were subsequently
|
|
deemed specious,
|
|
and the restriction was removed in Linux 4.10 because some
|
|
user-space applications needed to perform this operation more than once.
|
|
</DL>
|
|
<P>
|
|
|
|
The following options are available since Linux 3.18.
|
|
|
|
<DL COMPACT>
|
|
<DT id="78"><B>PR_SET_MM_MAP</B>
|
|
|
|
<DD>
|
|
Provides one-shot access to all the addresses by passing in a
|
|
<I>struct prctl_mm_map</I>
|
|
|
|
(as defined in <I><<A HREF="file:///usr/include/linux/prctl.h">linux/prctl.h</A>></I>).
|
|
The
|
|
<I>arg4</I>
|
|
|
|
argument should provide the size of the struct.
|
|
<DT id="79"><DD>
|
|
This feature is available only if the kernel is built with the
|
|
<B>CONFIG_CHECKPOINT_RESTORE</B>
|
|
|
|
option enabled.
|
|
<DT id="80"><B>PR_SET_MM_MAP_SIZE</B>
|
|
|
|
<DD>
|
|
Returns the size of the
|
|
<I>struct prctl_mm_map</I>
|
|
|
|
the kernel expects.
|
|
This allows user space to find a compatible struct.
|
|
The
|
|
<I>arg4</I>
|
|
|
|
argument should be a pointer to an unsigned int.
|
|
<DT id="81"><DD>
|
|
This feature is available only if the kernel is built with the
|
|
<B>CONFIG_CHECKPOINT_RESTORE</B>
|
|
|
|
option enabled.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="82"><B>PR_MPX_ENABLE_MANAGEMENT</B>, <B>PR_MPX_DISABLE_MANAGEMENT</B> (since Linux 3.19)
|
|
|
|
<DD>
|
|
|
|
|
|
|
|
Enable or disable kernel management of Memory Protection eXtensions (MPX)
|
|
bounds tables.
|
|
The
|
|
<I>arg2</I>,
|
|
|
|
<I>arg3</I>,
|
|
|
|
<I>arg4</I>,
|
|
|
|
and
|
|
<I>arg5</I>
|
|
|
|
|
|
arguments must be zero.
|
|
<DT id="83"><DD>
|
|
MPX is a hardware-assisted mechanism for performing bounds checking on
|
|
pointers.
|
|
It consists of a set of registers storing bounds information
|
|
and a set of special instruction prefixes that tell the CPU on which
|
|
instructions it should do bounds enforcement.
|
|
There is a limited number of these registers and
|
|
when there are more pointers than registers,
|
|
their contents must be "spilled" into a set of tables.
|
|
These tables are called "bounds tables" and the MPX
|
|
<B>prctl</B>()
|
|
|
|
operations control
|
|
whether the kernel manages their allocation and freeing.
|
|
<DT id="84"><DD>
|
|
When management is enabled, the kernel will take over allocation
|
|
and freeing of the bounds tables.
|
|
It does this by trapping the #BR exceptions that result
|
|
at first use of missing bounds tables and
|
|
instead of delivering the exception to user space,
|
|
it allocates the table and populates the bounds directory
|
|
with the location of the new table.
|
|
For freeing, the kernel checks to see if bounds tables are
|
|
present for memory which is not allocated, and frees them if so.
|
|
<DT id="85"><DD>
|
|
Before enabling MPX management using
|
|
<B>PR_MPX_ENABLE_MANAGEMENT</B>,
|
|
|
|
the application must first have allocated a user-space buffer for
|
|
the bounds directory and placed the location of that directory in the
|
|
<I>bndcfgu</I>
|
|
|
|
register.
|
|
<DT id="86"><DD>
|
|
These calls fail if the CPU or kernel does not support MPX.
|
|
Kernel support for MPX is enabled via the
|
|
<B>CONFIG_X86_INTEL_MPX</B>
|
|
|
|
configuration option.
|
|
You can check whether the CPU supports MPX by looking for the 'mpx'
|
|
CPUID bit, like with the following command:
|
|
<DT id="87"><DD>
|
|
|
|
|
|
cat /proc/cpuinfo | grep ' mpx '
|
|
|
|
|
|
<DT id="88"><DD>
|
|
A thread may not switch in or out of long (64-bit) mode while MPX is
|
|
enabled.
|
|
<DT id="89"><DD>
|
|
All threads in a process are affected by these calls.
|
|
<DT id="90"><DD>
|
|
The child of a
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2)
|
|
|
|
inherits the state of MPX management.
|
|
During
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
MPX management is reset to a state as if
|
|
<B>PR_MPX_DISABLE_MANAGEMENT</B>
|
|
|
|
had been called.
|
|
<DT id="91"><DD>
|
|
For further information on Intel MPX, see the kernel source file
|
|
<I>Documentation/x86/intel_mpx.txt</I>.
|
|
|
|
<DT id="92"><B>PR_SET_NAME</B> (since Linux 2.6.9)
|
|
|
|
<DD>
|
|
Set the name of the calling thread,
|
|
using the value in the location pointed to by
|
|
<I>(char *) arg2</I>.
|
|
|
|
The name can be up to 16 bytes long,
|
|
|
|
including the terminating null byte.
|
|
(If the length of the string, including the terminating null byte,
|
|
exceeds 16 bytes, the string is silently truncated.)
|
|
This is the same attribute that can be set via
|
|
<B><A HREF="/cgi-bin/man/man2html?3+pthread_setname_np">pthread_setname_np</A></B>(3)
|
|
|
|
and retrieved using
|
|
<B><A HREF="/cgi-bin/man/man2html?3+pthread_getname_np">pthread_getname_np</A></B>(3).
|
|
|
|
The attribute is likewise accessible via
|
|
<I>/proc/self/task/[tid]/comm</I>,
|
|
|
|
where
|
|
<I>tid</I>
|
|
|
|
is the name of the calling thread.
|
|
<DT id="93"><B>PR_GET_NAME</B> (since Linux 2.6.11)
|
|
|
|
<DD>
|
|
Return the name of the calling thread,
|
|
in the buffer pointed to by
|
|
<I>(char *) arg2</I>.
|
|
|
|
The buffer should allow space for up to 16 bytes;
|
|
the returned string will be null-terminated.
|
|
<DT id="94"><B>PR_SET_NO_NEW_PRIVS</B> (since Linux 3.5)
|
|
|
|
<DD>
|
|
Set the calling thread's
|
|
<I>no_new_privs</I>
|
|
|
|
attribute to the value in
|
|
<I>arg2</I>.
|
|
|
|
With
|
|
<I>no_new_privs</I>
|
|
|
|
set to 1,
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
promises not to grant privileges to do anything
|
|
that could not have been done without the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
call (for example,
|
|
rendering the set-user-ID and set-group-ID mode bits,
|
|
and file capabilities non-functional).
|
|
Once set, this the
|
|
<I>no_new_privs</I>
|
|
|
|
attribute cannot be unset.
|
|
The setting of this attribute is inherited by children created by
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+clone">clone</A></B>(2),
|
|
|
|
and preserved across
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="95"><DD>
|
|
Since Linux 4.10,
|
|
the value of a thread's
|
|
<I>no_new_privs</I>
|
|
|
|
attribute can be viewed via the
|
|
<I>NoNewPrivs</I>
|
|
|
|
field in the
|
|
<I>/proc/[pid]/status</I>
|
|
|
|
file.
|
|
<DT id="96"><DD>
|
|
For more information, see the kernel source file
|
|
<I>Documentation/userspace-api/no_new_privs.rst</I>
|
|
|
|
|
|
(or
|
|
<I>Documentation/prctl/no_new_privs.txt</I>
|
|
|
|
before Linux 4.13).
|
|
See also
|
|
<B><A HREF="/cgi-bin/man/man2html?2+seccomp">seccomp</A></B>(2).
|
|
|
|
<DT id="97"><B>PR_GET_NO_NEW_PRIVS</B> (since Linux 3.5)
|
|
|
|
<DD>
|
|
Return (as the function result) the value of the
|
|
<I>no_new_privs</I>
|
|
|
|
attribute for the calling thread.
|
|
A value of 0 indicates the regular
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
behavior.
|
|
A value of 1 indicates
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
will operate in the privilege-restricting mode described above.
|
|
<DT id="98"><B>PR_SET_PDEATHSIG</B> (since Linux 2.1.57)
|
|
|
|
<DD>
|
|
Set the parent-death signal
|
|
of the calling process to <I>arg2</I> (either a signal value
|
|
in the range 1..maxsig, or 0 to clear).
|
|
This is the signal that the calling process will get when its
|
|
parent dies.
|
|
<DT id="99"><DD>
|
|
<I>Warning</I>:
|
|
|
|
|
|
the "parent" in this case is considered to be the
|
|
<I>thread</I>
|
|
|
|
that created this process.
|
|
In other words, the signal will be sent when that thread terminates
|
|
(via, for example,
|
|
<B><A HREF="/cgi-bin/man/man2html?3+pthread_exit">pthread_exit</A></B>(3)),
|
|
|
|
rather than after all of the threads in the parent process terminate.
|
|
<DT id="100"><DD>
|
|
The parent-death signal is sent upon subsequent termination of the parent
|
|
thread and also upon termination of each subreaper process
|
|
(see the description of
|
|
<B>PR_SET_CHILD_SUBREAPER</B>
|
|
|
|
above) to which the caller is subsequently reparented.
|
|
If the parent thread and all ancestor subreapers have already terminated
|
|
by the time of the
|
|
<B>PR_SET_PDEATHSIG</B>
|
|
|
|
operation, then no parent-death signal is sent to the caller.
|
|
<DT id="101"><DD>
|
|
The parent-death signal is process-directed (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+signal">signal</A></B>(7))
|
|
|
|
and, if the child installs a handler using the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+sigaction">sigaction</A></B>(2)
|
|
|
|
<B>SA_SIGINFO</B>
|
|
|
|
flag, the
|
|
<I>si_pid</I>
|
|
|
|
field of the
|
|
<I>siginfo_t</I>
|
|
|
|
argument of the handler contains the PID of the terminating parent process.
|
|
<DT id="102"><DD>
|
|
The parent-death signal setting is cleared for the child of a
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2).
|
|
|
|
It is also
|
|
(since Linux 2.4.36 / 2.6.23)
|
|
|
|
cleared when executing a set-user-ID or set-group-ID binary,
|
|
or a binary that has associated capabilities (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7));
|
|
|
|
otherwise, this value is preserved across
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="103"><B>PR_GET_PDEATHSIG</B> (since Linux 2.3.15)
|
|
|
|
<DD>
|
|
Return the current value of the parent process death signal,
|
|
in the location pointed to by
|
|
<I>(int *) arg2</I>.
|
|
|
|
<DT id="104"><B>PR_SET_PTRACER</B> (since Linux 3.4)
|
|
|
|
<DD>
|
|
|
|
|
|
This is meaningful only when the Yama LSM is enabled and in mode 1
|
|
("restricted ptrace", visible via
|
|
<I>/proc/sys/kernel/yama/ptrace_scope</I>).
|
|
|
|
When a "ptracer process ID" is passed in <I>arg2</I>,
|
|
the caller is declaring that the ptracer process can
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ptrace">ptrace</A></B>(2)
|
|
|
|
the calling process as if it were a direct process ancestor.
|
|
Each
|
|
<B>PR_SET_PTRACER</B>
|
|
|
|
operation replaces the previous "ptracer process ID".
|
|
Employing
|
|
<B>PR_SET_PTRACER</B>
|
|
|
|
with
|
|
<I>arg2</I>
|
|
|
|
set to 0 clears the caller's "ptracer process ID".
|
|
If
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>PR_SET_PTRACER_ANY</B>,
|
|
|
|
the ptrace restrictions introduced by Yama are effectively disabled for the
|
|
calling process.
|
|
<DT id="105"><DD>
|
|
For further information, see the kernel source file
|
|
<I>Documentation/admin-guide/LSM/Yama.rst</I>
|
|
|
|
|
|
(or
|
|
<I>Documentation/security/Yama.txt</I>
|
|
|
|
before Linux 4.13).
|
|
<DT id="106"><B>PR_SET_SECCOMP</B> (since Linux 2.6.23)
|
|
|
|
<DD>
|
|
|
|
|
|
|
|
Set the secure computing (seccomp) mode for the calling thread, to limit
|
|
the available system calls.
|
|
The more recent
|
|
<B><A HREF="/cgi-bin/man/man2html?2+seccomp">seccomp</A></B>(2)
|
|
|
|
system call provides a superset of the functionality of
|
|
<B>PR_SET_SECCOMP</B>.
|
|
|
|
<DT id="107"><DD>
|
|
The seccomp mode is selected via
|
|
<I>arg2</I>.
|
|
|
|
(The seccomp constants are defined in
|
|
<I><<A HREF="file:///usr/include/linux/seccomp.h">linux/seccomp.h</A>></I>.)
|
|
|
|
<DT id="108"><DD>
|
|
With
|
|
<I>arg2</I>
|
|
|
|
set to
|
|
<B>SECCOMP_MODE_STRICT</B>,
|
|
|
|
the only system calls that the thread is permitted to make are
|
|
<B><A HREF="/cgi-bin/man/man2html?2+read">read</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+write">write</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+_exit">_exit</A></B>(2)
|
|
|
|
(but not
|
|
<B><A HREF="/cgi-bin/man/man2html?2+exit_group">exit_group</A></B>(2)),
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+sigreturn">sigreturn</A></B>(2).
|
|
|
|
Other system calls result in the delivery of a
|
|
<B>SIGKILL</B>
|
|
|
|
signal.
|
|
Strict secure computing mode is useful for number-crunching applications
|
|
that may need to execute untrusted byte code,
|
|
perhaps obtained by reading from a pipe or socket.
|
|
This operation is available only
|
|
if the kernel is configured with
|
|
<B>CONFIG_SECCOMP</B>
|
|
|
|
enabled.
|
|
<DT id="109"><DD>
|
|
With
|
|
<I>arg2</I>
|
|
|
|
set to
|
|
<B>SECCOMP_MODE_FILTER</B> (since Linux 3.5),
|
|
|
|
the system calls allowed are defined by a pointer
|
|
to a Berkeley Packet Filter passed in
|
|
<I>arg3</I>.
|
|
|
|
This argument is a pointer to
|
|
<I>struct sock_fprog</I>;
|
|
|
|
it can be designed to filter
|
|
arbitrary system calls and system call arguments.
|
|
This mode is available only if the kernel is configured with
|
|
<B>CONFIG_SECCOMP_FILTER</B>
|
|
|
|
enabled.
|
|
<DT id="110"><DD>
|
|
If
|
|
<B>SECCOMP_MODE_FILTER</B>
|
|
|
|
filters permit
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2),
|
|
|
|
then the seccomp mode is inherited by children created by
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2);
|
|
|
|
if
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
is permitted, then the seccomp mode is preserved across
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
If the filters permit
|
|
<B>prctl</B>()
|
|
|
|
calls, then additional filters can be added;
|
|
they are run in order until the first non-allow result is seen.
|
|
<DT id="111"><DD>
|
|
For further information, see the kernel source file
|
|
<I>Documentation/userspace-api/seccomp_filter.rst</I>
|
|
|
|
|
|
(or
|
|
<I>Documentation/prctl/seccomp_filter.txt</I>
|
|
|
|
before Linux 4.13).
|
|
<DT id="112"><B>PR_GET_SECCOMP</B> (since Linux 2.6.23)
|
|
|
|
<DD>
|
|
Return (as the function result)
|
|
the secure computing mode of the calling thread.
|
|
If the caller is not in secure computing mode, this operation returns 0;
|
|
if the caller is in strict secure computing mode, then the
|
|
<B>prctl</B>()
|
|
|
|
call will cause a
|
|
<B>SIGKILL</B>
|
|
|
|
signal to be sent to the process.
|
|
If the caller is in filter mode, and this system call is allowed by the
|
|
seccomp filters, it returns 2; otherwise, the process is killed with a
|
|
<B>SIGKILL</B>
|
|
|
|
signal.
|
|
This operation is available only
|
|
if the kernel is configured with
|
|
<B>CONFIG_SECCOMP</B>
|
|
|
|
enabled.
|
|
<DT id="113"><DD>
|
|
Since Linux 3.8, the
|
|
<I>Seccomp</I>
|
|
|
|
field of the
|
|
<I>/proc/[pid]/status</I>
|
|
|
|
file provides a method of obtaining the same information,
|
|
without the risk that the process is killed; see
|
|
<B><A HREF="/cgi-bin/man/man2html?5+proc">proc</A></B>(5).
|
|
|
|
<DT id="114"><B>PR_SET_SECUREBITS</B> (since Linux 2.6.26)
|
|
|
|
<DD>
|
|
Set the "securebits" flags of the calling thread to the value supplied in
|
|
<I>arg2</I>.
|
|
|
|
See
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7).
|
|
|
|
<DT id="115"><B>PR_GET_SECUREBITS</B> (since Linux 2.6.26)
|
|
|
|
<DD>
|
|
Return (as the function result)
|
|
the "securebits" flags of the calling thread.
|
|
See
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7).
|
|
|
|
<DT id="116"><B>PR_GET_SPECULATION_CTRL</B> (since Linux 4.17)
|
|
|
|
<DD>
|
|
Return (as the function result)
|
|
the state of the speculation misfeature specified in
|
|
<I>arg2</I>.
|
|
|
|
Currently, the only permitted value for this argument is
|
|
<B>PR_SPEC_STORE_BYPASS</B>
|
|
|
|
(otherwise the call fails with the error
|
|
<B>ENODEV</B>).
|
|
|
|
<DT id="117"><DD>
|
|
The return value uses bits 0-3 with the following meaning:
|
|
<DL COMPACT><DT id="118"><DD>
|
|
<DL COMPACT>
|
|
<DT id="119"><B>PR_SPEC_PRCTL</B>
|
|
|
|
<DD>
|
|
Mitigation can be controlled per thread by
|
|
<B>PR_SET_SPECULATION_CTRL</B>
|
|
|
|
<DT id="120"><B>PR_SPEC_ENABLE</B>
|
|
|
|
<DD>
|
|
The speculation feature is enabled, mitigation is disabled.
|
|
<DT id="121"><B>PR_SPEC_DISABLE</B>
|
|
|
|
<DD>
|
|
The speculation feature is disabled, mitigation is enabled
|
|
<DT id="122"><B>PR_SPEC_FORCE_DISABLE</B>
|
|
|
|
<DD>
|
|
Same as
|
|
<B>PR_SPEC_DISABLE</B>
|
|
|
|
but cannot be undone.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="123"><DD>
|
|
If all bits are 0,
|
|
then the CPU is not affected by the speculation misfeature.
|
|
<DT id="124"><DD>
|
|
If
|
|
<B>PR_SPEC_PRCTL</B>
|
|
|
|
is set, then per-thread control of the mitigation is available.
|
|
If not set,
|
|
<B>prctl</B>()
|
|
|
|
for the speculation misfeature will fail.
|
|
<DT id="125"><DD>
|
|
The
|
|
<I>arg3</I>,
|
|
|
|
<I>arg4</I>,
|
|
|
|
and
|
|
<I>arg5</I>
|
|
|
|
arguments must be specified as 0; otherwise the call fails with the error
|
|
<B>EINVAL</B>.
|
|
|
|
<DT id="126"><B>PR_SET_SPECULATION_CTRL</B> (since Linux 4.17)
|
|
|
|
<DD>
|
|
|
|
|
|
Sets the state of the speculation misfeature specified in
|
|
<I>arg2</I>.
|
|
|
|
Currently, the only permitted value for this argument is
|
|
<B>PR_SPEC_STORE_BYPASS</B>
|
|
|
|
(otherwise the call fails with the error
|
|
<B>ENODEV</B>).
|
|
|
|
This setting is a per-thread attribute.
|
|
The
|
|
<I>arg3</I>
|
|
|
|
argument is used to hand in the control value,
|
|
which is one of the following:
|
|
<DL COMPACT><DT id="127"><DD>
|
|
<DL COMPACT>
|
|
<DT id="128"><B>PR_SPEC_ENABLE</B>
|
|
|
|
<DD>
|
|
The speculation feature is enabled, mitigation is disabled.
|
|
<DT id="129"><B>PR_SPEC_DISABLE</B>
|
|
|
|
<DD>
|
|
The speculation feature is disabled, mitigation is enabled
|
|
<DT id="130"><B>PR_SPEC_FORCE_DISABLE</B>
|
|
|
|
<DD>
|
|
Same as
|
|
<B>PR_SPEC_DISABLE</B>
|
|
|
|
but cannot be undone.
|
|
A subsequent
|
|
<B>prctl(..., PR_SPEC_ENABLE)</B>
|
|
|
|
will fail with the error
|
|
<B>EPERM</B>.
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="131"><DD>
|
|
Any other value in
|
|
<I>arg3</I>
|
|
|
|
will result in the call failing with the error
|
|
<B>ERANGE</B>.
|
|
|
|
<DT id="132"><DD>
|
|
The
|
|
<I>arg4</I>
|
|
|
|
and
|
|
<I>arg5</I>
|
|
|
|
arguments must be specified as 0; otherwise the call fails with the error
|
|
<B>EINVAL</B>.
|
|
|
|
<DT id="133"><DD>
|
|
The speculation feature can also be controlled by the
|
|
<B>spec_store_bypass_disable</B>
|
|
|
|
boot parameter.
|
|
This parameter may enforce a read-only policy which will result in the
|
|
<B>prctl</B>()
|
|
|
|
call failing with the error
|
|
<B>ENXIO</B>.
|
|
|
|
For further details, see the kernel source file
|
|
<I>Documentation/admin-guide/kernel-parameters.txt</I>.
|
|
|
|
<DT id="134"><B>PR_SET_THP_DISABLE</B> (since Linux 3.15)
|
|
|
|
<DD>
|
|
|
|
Set the state of the "THP disable" flag for the calling thread.
|
|
If
|
|
<I>arg2</I>
|
|
|
|
has a nonzero value, the flag is set, otherwise it is cleared.
|
|
Setting this flag provides a method
|
|
for disabling transparent huge pages
|
|
for jobs where the code cannot be modified, and using a malloc hook with
|
|
<B><A HREF="/cgi-bin/man/man2html?2+madvise">madvise</A></B>(2)
|
|
|
|
is not an option (i.e., statically allocated data).
|
|
The setting of the "THP disable" flag is inherited by a child created via
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2)
|
|
|
|
and is preserved across
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
|
|
<DT id="135"><B>PR_TASK_PERF_EVENTS_DISABLE</B> (since Linux 2.6.31)
|
|
|
|
<DD>
|
|
Disable all performance counters attached to the calling process,
|
|
regardless of whether the counters were created by
|
|
this process or another process.
|
|
Performance counters created by the calling process for other
|
|
processes are unaffected.
|
|
For more information on performance counters, see the Linux kernel source file
|
|
<I>tools/perf/design.txt</I>.
|
|
|
|
<DT id="136"><DD>
|
|
Originally called
|
|
<B>PR_TASK_PERF_COUNTERS_DISABLE</B>;
|
|
|
|
|
|
renamed (retaining the same numerical value)
|
|
in Linux 2.6.32.
|
|
|
|
<DT id="137"><B>PR_TASK_PERF_EVENTS_ENABLE</B> (since Linux 2.6.31)
|
|
|
|
<DD>
|
|
The converse of
|
|
<B>PR_TASK_PERF_EVENTS_DISABLE</B>;
|
|
|
|
enable performance counters attached to the calling process.
|
|
<DT id="138"><DD>
|
|
Originally called
|
|
<B>PR_TASK_PERF_COUNTERS_ENABLE</B>;
|
|
|
|
|
|
renamed
|
|
|
|
in Linux 2.6.32.
|
|
|
|
<DT id="139"><B>PR_GET_THP_DISABLE</B> (since Linux 3.15)
|
|
|
|
<DD>
|
|
Return (as the function result) the current setting of the "THP disable"
|
|
flag for the calling thread:
|
|
either 1, if the flag is set, or 0, if it is not.
|
|
<DT id="140"><B>PR_GET_TID_ADDRESS</B> (since Linux 3.5)
|
|
|
|
<DD>
|
|
|
|
Return the
|
|
<I>clear_child_tid</I>
|
|
|
|
address set by
|
|
<B><A HREF="/cgi-bin/man/man2html?2+set_tid_address">set_tid_address</A></B>(2)
|
|
|
|
and the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+clone">clone</A></B>(2)
|
|
|
|
<B>CLONE_CHILD_CLEARTID</B>
|
|
|
|
flag, in the location pointed to by
|
|
<I>(int **) arg2</I>.
|
|
|
|
This feature is available only if the kernel is built with the
|
|
<B>CONFIG_CHECKPOINT_RESTORE</B>
|
|
|
|
option enabled.
|
|
Note that since the
|
|
<B>prctl</B>()
|
|
|
|
system call does not have a compat implementation for
|
|
the AMD64 x32 and MIPS n32 ABIs,
|
|
and the kernel writes out a pointer using the kernel's pointer size,
|
|
this operation expects a user-space buffer of 8 (not 4) bytes on these ABIs.
|
|
<DT id="141"><B>PR_SET_TIMERSLACK</B> (since Linux 2.6.28)
|
|
|
|
<DD>
|
|
|
|
|
|
Each thread has two associated timer slack values:
|
|
a "default" value, and a "current" value.
|
|
This operation sets the "current" timer slack value for the calling thread.
|
|
<I>arg2</I>
|
|
|
|
is an unsigned long value, then maximum "current" value is ULONG_MAX and
|
|
the minimum "current" value is 1.
|
|
If the nanosecond value supplied in
|
|
<I>arg2</I>
|
|
|
|
is greater than zero, then the "current" value is set to this value.
|
|
If
|
|
<I>arg2</I>
|
|
|
|
is equal to zero,
|
|
the "current" timer slack is reset to the
|
|
thread's "default" timer slack value.
|
|
<DT id="142"><DD>
|
|
The "current" timer slack is used by the kernel to group timer expirations
|
|
for the calling thread that are close to one another;
|
|
as a consequence, timer expirations for the thread may be
|
|
up to the specified number of nanoseconds late (but will never expire early).
|
|
Grouping timer expirations can help reduce system power consumption
|
|
by minimizing CPU wake-ups.
|
|
<DT id="143"><DD>
|
|
The timer expirations affected by timer slack are those set by
|
|
<B><A HREF="/cgi-bin/man/man2html?2+select">select</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+pselect">pselect</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+poll">poll</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ppoll">ppoll</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+epoll_wait">epoll_wait</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+epoll_pwait">epoll_pwait</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+clock_nanosleep">clock_nanosleep</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+nanosleep">nanosleep</A></B>(2),
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+futex">futex</A></B>(2)
|
|
|
|
(and thus the library functions implemented via futexes, including
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+pthread_cond_timedwait">pthread_cond_timedwait</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+pthread_mutex_timedlock">pthread_mutex_timedlock</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+pthread_rwlock_timedrdlock">pthread_rwlock_timedrdlock</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+pthread_rwlock_timedwrlock">pthread_rwlock_timedwrlock</A></B>(3),
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?3+sem_timedwait">sem_timedwait</A></B>(3)).
|
|
|
|
<DT id="144"><DD>
|
|
Timer slack is not applied to threads that are scheduled under
|
|
a real-time scheduling policy (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+sched_setscheduler">sched_setscheduler</A></B>(2)).
|
|
|
|
<DT id="145"><DD>
|
|
When a new thread is created,
|
|
the two timer slack values are made the same as the "current" value
|
|
of the creating thread.
|
|
Thereafter, a thread can adjust its "current" timer slack value via
|
|
<B>PR_SET_TIMERSLACK</B>.
|
|
|
|
The "default" value can't be changed.
|
|
The timer slack values of
|
|
<I>init</I>
|
|
|
|
(PID 1), the ancestor of all processes,
|
|
are 50,000 nanoseconds (50 microseconds).
|
|
The timer slack value is inherited by a child created via
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2),
|
|
|
|
and is preserved across
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="146"><DD>
|
|
Since Linux 4.6, the "current" timer slack value of any process
|
|
can be examined and changed via the file
|
|
<I>/proc/[pid]/timerslack_ns</I>.
|
|
|
|
See
|
|
<B><A HREF="/cgi-bin/man/man2html?5+proc">proc</A></B>(5).
|
|
|
|
<DT id="147"><B>PR_GET_TIMERSLACK</B> (since Linux 2.6.28)
|
|
|
|
<DD>
|
|
Return (as the function result)
|
|
the "current" timer slack value of the calling thread.
|
|
<DT id="148"><B>PR_SET_TIMING</B> (since Linux 2.6.0)
|
|
|
|
<DD>
|
|
|
|
Set whether to use (normal, traditional) statistical process timing or
|
|
accurate timestamp-based process timing, by passing
|
|
<B>PR_TIMING_STATISTICAL</B>
|
|
|
|
|
|
or
|
|
<B>PR_TIMING_TIMESTAMP</B>
|
|
|
|
|
|
to <I>arg2</I>.
|
|
<B>PR_TIMING_TIMESTAMP</B>
|
|
|
|
is not currently implemented
|
|
(attempting to set this mode will yield the error
|
|
<B>EINVAL</B>).
|
|
|
|
|
|
|
|
|
|
<DT id="149"><B>PR_GET_TIMING</B> (since Linux 2.6.0)
|
|
|
|
<DD>
|
|
|
|
Return (as the function result) which process timing method is currently
|
|
in use.
|
|
<DT id="150"><B>PR_SET_TSC</B> (since Linux 2.6.26, x86 only)
|
|
|
|
<DD>
|
|
Set the state of the flag determining whether the timestamp counter
|
|
can be read by the process.
|
|
Pass
|
|
<B>PR_TSC_ENABLE</B>
|
|
|
|
to
|
|
<I>arg2</I>
|
|
|
|
to allow it to be read, or
|
|
<B>PR_TSC_SIGSEGV</B>
|
|
|
|
to generate a
|
|
<B>SIGSEGV</B>
|
|
|
|
when the process tries to read the timestamp counter.
|
|
<DT id="151"><B>PR_GET_TSC</B> (since Linux 2.6.26, x86 only)
|
|
|
|
<DD>
|
|
Return the state of the flag determining whether the timestamp counter
|
|
can be read,
|
|
in the location pointed to by
|
|
<I>(int *) arg2</I>.
|
|
|
|
<DT id="152"><B>PR_SET_UNALIGN</B>
|
|
|
|
<DD>
|
|
(Only on: ia64, since Linux 2.3.48; parisc, since Linux 2.6.15;
|
|
PowerPC, since Linux 2.6.18; Alpha, since Linux 2.6.22;
|
|
|
|
|
|
sh, since Linux 2.6.34; tile, since Linux 3.12)
|
|
Set unaligned access control bits to <I>arg2</I>.
|
|
Pass
|
|
<B>PR_UNALIGN_NOPRINT</B> to silently fix up unaligned user accesses,
|
|
or <B>PR_UNALIGN_SIGBUS</B> to generate
|
|
<B>SIGBUS</B>
|
|
|
|
on unaligned user access.
|
|
Alpha also supports an additional flag with the value
|
|
of 4 and no corresponding named constant,
|
|
which instructs kernel to not fix up
|
|
unaligned accesses (it is analogous to providing the
|
|
<B>UAC_NOFIX</B>
|
|
|
|
flag in
|
|
<B>SSI_NVPAIRS</B>
|
|
|
|
operation of the
|
|
<B>setsysinfo</B>()
|
|
|
|
system call on Tru64).
|
|
<DT id="153"><B>PR_GET_UNALIGN</B>
|
|
|
|
<DD>
|
|
(See
|
|
<B>PR_SET_UNALIGN</B>
|
|
|
|
for information on versions and architectures.)
|
|
Return unaligned access control bits, in the location pointed to by
|
|
<I>(unsigned int *) arg2</I>.
|
|
|
|
</DL>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>RETURN VALUE</H2>
|
|
|
|
On success,
|
|
<B>PR_GET_DUMPABLE</B>,
|
|
|
|
<B>PR_GET_FP_MODE</B>,
|
|
|
|
<B>PR_GET_KEEPCAPS</B>,
|
|
|
|
<B>PR_GET_NO_NEW_PRIVS</B>,
|
|
|
|
<B>PR_GET_THP_DISABLE</B>,
|
|
|
|
<B>PR_CAPBSET_READ</B>,
|
|
|
|
<B>PR_GET_TIMING</B>,
|
|
|
|
<B>PR_GET_TIMERSLACK</B>,
|
|
|
|
<B>PR_GET_SECUREBITS</B>,
|
|
|
|
<B>PR_GET_SPECULATION_CTRL</B>,
|
|
|
|
<B>PR_MCE_KILL_GET</B>,
|
|
|
|
<B>PR_CAP_AMBIENT</B>+<B>PR_CAP_AMBIENT_IS_SET</B>,
|
|
|
|
and (if it returns)
|
|
<B>PR_GET_SECCOMP</B>
|
|
|
|
return the nonnegative values described above.
|
|
All other
|
|
<I>option</I>
|
|
|
|
values return 0 on success.
|
|
On error, -1 is returned, and
|
|
<I>errno</I>
|
|
|
|
is set appropriately.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>ERRORS</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="154"><B>EACCES</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_SECCOMP</B>
|
|
|
|
and
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>SECCOMP_MODE_FILTER</B>,
|
|
|
|
but the process does not have the
|
|
<B>CAP_SYS_ADMIN</B>
|
|
|
|
capability or has not set the
|
|
<I>no_new_privs</I>
|
|
|
|
attribute (see the discussion of
|
|
<B>PR_SET_NO_NEW_PRIVS</B>
|
|
|
|
above).
|
|
<DT id="155"><B>EACCES</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_MM</B>,
|
|
|
|
and
|
|
<I>arg3</I>
|
|
|
|
is
|
|
<B>PR_SET_MM_EXE_FILE</B>,
|
|
|
|
the file is not executable.
|
|
<DT id="156"><B>EBADF</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_MM</B>,
|
|
|
|
<I>arg3</I>
|
|
|
|
is
|
|
<B>PR_SET_MM_EXE_FILE</B>,
|
|
|
|
and the file descriptor passed in
|
|
<I>arg4</I>
|
|
|
|
is not valid.
|
|
<DT id="157"><B>EBUSY</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_MM</B>,
|
|
|
|
<I>arg3</I>
|
|
|
|
is
|
|
<B>PR_SET_MM_EXE_FILE</B>,
|
|
|
|
and this the second attempt to change the
|
|
<I>/proc/pid/exe</I>
|
|
|
|
symbolic link, which is prohibited.
|
|
<DT id="158"><B>EFAULT</B>
|
|
|
|
<DD>
|
|
<I>arg2</I>
|
|
|
|
is an invalid address.
|
|
<DT id="159"><B>EFAULT</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_SECCOMP</B>,
|
|
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>SECCOMP_MODE_FILTER</B>,
|
|
|
|
the system was built with
|
|
<B>CONFIG_SECCOMP_FILTER</B>,
|
|
|
|
and
|
|
<I>arg3</I>
|
|
|
|
is an invalid address.
|
|
<DT id="160"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
The value of
|
|
<I>option</I>
|
|
|
|
is not recognized.
|
|
<DT id="161"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_MCE_KILL</B>
|
|
|
|
or
|
|
<B>PR_MCE_KILL_GET</B>
|
|
|
|
or
|
|
<B>PR_SET_MM</B>,
|
|
|
|
and unused
|
|
<B>prctl</B>()
|
|
|
|
arguments were not specified as zero.
|
|
<DT id="162"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>arg2</I>
|
|
|
|
is not valid value for this
|
|
<I>option</I>.
|
|
|
|
<DT id="163"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_SECCOMP</B>
|
|
|
|
or
|
|
<B>PR_GET_SECCOMP</B>,
|
|
|
|
and the kernel was not configured with
|
|
<B>CONFIG_SECCOMP</B>.
|
|
|
|
<DT id="164"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_SECCOMP</B>,
|
|
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>SECCOMP_MODE_FILTER</B>,
|
|
|
|
and the kernel was not configured with
|
|
<B>CONFIG_SECCOMP_FILTER</B>.
|
|
|
|
<DT id="165"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_MM</B>,
|
|
|
|
and one of the following is true
|
|
<DL COMPACT><DT id="166"><DD>
|
|
<DL COMPACT>
|
|
<DT id="167">*<DD>
|
|
<I>arg4</I>
|
|
|
|
or
|
|
<I>arg5</I>
|
|
|
|
is nonzero;
|
|
<DT id="168">*<DD>
|
|
<I>arg3</I>
|
|
|
|
is greater than
|
|
<B>TASK_SIZE</B>
|
|
|
|
(the limit on the size of the user address space for this architecture);
|
|
<DT id="169">*<DD>
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>PR_SET_MM_START_CODE</B>,
|
|
|
|
<B>PR_SET_MM_END_CODE</B>,
|
|
|
|
<B>PR_SET_MM_START_DATA</B>,
|
|
|
|
<B>PR_SET_MM_END_DATA</B>,
|
|
|
|
or
|
|
<B>PR_SET_MM_START_STACK</B>,
|
|
|
|
and the permissions of the corresponding memory area are not as required;
|
|
<DT id="170">*<DD>
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>PR_SET_MM_START_BRK</B>
|
|
|
|
or
|
|
<B>PR_SET_MM_BRK</B>,
|
|
|
|
and
|
|
<I>arg3</I>
|
|
|
|
is less than or equal to the end of the data segment
|
|
or specifies a value that would cause the
|
|
<B>RLIMIT_DATA</B>
|
|
|
|
resource limit to be exceeded.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="171"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_PTRACER</B>
|
|
|
|
and
|
|
<I>arg2</I>
|
|
|
|
is not 0,
|
|
<B>PR_SET_PTRACER_ANY</B>,
|
|
|
|
or the PID of an existing process.
|
|
<DT id="172"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_PDEATHSIG</B>
|
|
|
|
and
|
|
<I>arg2</I>
|
|
|
|
is not a valid signal number.
|
|
<DT id="173"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_DUMPABLE</B>
|
|
|
|
and
|
|
<I>arg2</I>
|
|
|
|
is neither
|
|
<B>SUID_DUMP_DISABLE</B>
|
|
|
|
nor
|
|
<B>SUID_DUMP_USER</B>.
|
|
|
|
<DT id="174"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_TIMING</B>
|
|
|
|
and
|
|
<I>arg2</I>
|
|
|
|
is not
|
|
<B>PR_TIMING_STATISTICAL</B>.
|
|
|
|
<DT id="175"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_NO_NEW_PRIVS</B>
|
|
|
|
and
|
|
<I>arg2</I>
|
|
|
|
is not equal to 1
|
|
or
|
|
<I>arg3</I>,
|
|
|
|
<I>arg4</I>,
|
|
|
|
or
|
|
<I>arg5</I>
|
|
|
|
is nonzero.
|
|
<DT id="176"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_GET_NO_NEW_PRIVS</B>
|
|
|
|
and
|
|
<I>arg2</I>,
|
|
|
|
<I>arg3</I>,
|
|
|
|
<I>arg4</I>,
|
|
|
|
or
|
|
<I>arg5</I>
|
|
|
|
is nonzero.
|
|
<DT id="177"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_THP_DISABLE</B>
|
|
|
|
and
|
|
<I>arg3</I>,
|
|
|
|
<I>arg4</I>,
|
|
|
|
or
|
|
<I>arg5</I>
|
|
|
|
is nonzero.
|
|
<DT id="178"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_GET_THP_DISABLE</B>
|
|
|
|
and
|
|
<I>arg2</I>,
|
|
|
|
<I>arg3</I>,
|
|
|
|
<I>arg4</I>,
|
|
|
|
or
|
|
<I>arg5</I>
|
|
|
|
is nonzero.
|
|
<DT id="179"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_CAP_AMBIENT</B>
|
|
|
|
and an unused argument
|
|
(<I>arg4</I>,
|
|
|
|
<I>arg5</I>,
|
|
|
|
or,
|
|
in the case of
|
|
<B>PR_CAP_AMBIENT_CLEAR_ALL</B>,
|
|
|
|
<I>arg3</I>)
|
|
|
|
is nonzero; or
|
|
<I>arg2</I>
|
|
|
|
has an invalid value;
|
|
or
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>PR_CAP_AMBIENT_LOWER</B>,
|
|
|
|
<B>PR_CAP_AMBIENT_RAISE</B>,
|
|
|
|
or
|
|
<B>PR_CAP_AMBIENT_IS_SET</B>
|
|
|
|
and
|
|
<I>arg3</I>
|
|
|
|
does not specify a valid capability.
|
|
<DT id="180"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
was
|
|
<B>PR_GET_SPECULATION_CTRL</B>
|
|
|
|
or
|
|
<B>PR_SET_SPECULATION_CTRL</B>
|
|
|
|
and unused arguments to
|
|
<B>prctl</B>()
|
|
|
|
are not 0.
|
|
<DT id="181"><B>ENODEV</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
was
|
|
<B>PR_SET_SPECULATION_CTRL</B>
|
|
|
|
the kernel or CPU does not support the requested speculation misfeature.
|
|
<DT id="182"><B>ENXIO</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
was
|
|
<B>PR_MPX_ENABLE_MANAGEMENT</B>
|
|
|
|
or
|
|
<B>PR_MPX_DISABLE_MANAGEMENT</B>
|
|
|
|
and the kernel or the CPU does not support MPX management.
|
|
Check that the kernel and processor have MPX support.
|
|
<DT id="183"><B>ENXIO</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
was
|
|
<B>PR_SET_SPECULATION_CTRL</B>
|
|
|
|
implies that the control of the selected speculation misfeature is not possible.
|
|
See
|
|
<B>PR_GET_SPECULATION_CTRL</B>
|
|
|
|
for the bit fields to determine which option is available.
|
|
<DT id="184"><B>EOPNOTSUPP</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_FP_MODE</B>
|
|
|
|
and
|
|
<I>arg2</I>
|
|
|
|
has an invalid or unsupported value.
|
|
<DT id="185"><B>EPERM</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_SECUREBITS</B>,
|
|
|
|
and the caller does not have the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability,
|
|
or tried to unset a "locked" flag,
|
|
or tried to set a flag whose corresponding locked flag was set
|
|
(see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7)).
|
|
|
|
<DT id="186"><B>EPERM</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_SPECULATION_CTRL</B>
|
|
|
|
wherein the speculation was disabled with
|
|
<B>PR_SPEC_FORCE_DISABLE</B>
|
|
|
|
and caller tried to enable it again.
|
|
<DT id="187"><B>EPERM</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_KEEPCAPS</B>,
|
|
|
|
and the caller's
|
|
<B>SECBIT_KEEP_CAPS_LOCKED</B>
|
|
|
|
flag is set
|
|
(see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7)).
|
|
|
|
<DT id="188"><B>EPERM</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_CAPBSET_DROP</B>,
|
|
|
|
and the caller does not have the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability.
|
|
<DT id="189"><B>EPERM</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_SET_MM</B>,
|
|
|
|
and the caller does not have the
|
|
<B>CAP_SYS_RESOURCE</B>
|
|
|
|
capability.
|
|
<DT id="190"><B>EPERM</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
is
|
|
<B>PR_CAP_AMBIENT</B>
|
|
|
|
and
|
|
<I>arg2</I>
|
|
|
|
is
|
|
<B>PR_CAP_AMBIENT_RAISE</B>,
|
|
|
|
but either the capability specified in
|
|
<I>arg3</I>
|
|
|
|
is not present in the process's permitted and inheritable capability sets,
|
|
or the
|
|
<B>PR_CAP_AMBIENT_LOWER</B>
|
|
|
|
securebit has been set.
|
|
<DT id="191"><B>ERANGE</B>
|
|
|
|
<DD>
|
|
<I>option</I>
|
|
|
|
was
|
|
<B>PR_SET_SPECULATION_CTRL</B>
|
|
|
|
and
|
|
<I>arg3</I>
|
|
|
|
is neither
|
|
<B>PR_SPEC_ENABLE</B>,
|
|
|
|
<B>PR_SPEC_DISABLE</B>,
|
|
|
|
nor
|
|
<B>PR_SPEC_FORCE_DISABLE</B>.
|
|
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>VERSIONS</H2>
|
|
|
|
The
|
|
<B>prctl</B>()
|
|
|
|
system call was introduced in Linux 2.1.57.
|
|
|
|
<A NAME="lbAH"> </A>
|
|
<H2>CONFORMING TO</H2>
|
|
|
|
This call is Linux-specific.
|
|
IRIX has a
|
|
<B>prctl</B>()
|
|
|
|
system call (also introduced in Linux 2.1.44
|
|
as irix_prctl on the MIPS architecture),
|
|
with prototype
|
|
<P>
|
|
|
|
|
|
|
|
<B>ptrdiff_t prctl(int </B><I>option</I><B>, int </B><I>arg2</I><B>, int </B><I>arg3</I><B>);</B>
|
|
|
|
|
|
|
|
<P>
|
|
|
|
and options to get the maximum number of processes per user,
|
|
get the maximum number of processors the calling process can use,
|
|
find out whether a specified process is currently blocked,
|
|
get or set the maximum stack size, and so on.
|
|
<A NAME="lbAI"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+signal">signal</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?5+core">core</A></B>(5)
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>COLOPHON</H2>
|
|
|
|
This page is part of release 5.05 of the Linux
|
|
<I>man-pages</I>
|
|
|
|
project.
|
|
A description of the project,
|
|
information about reporting bugs,
|
|
and the latest version of this page,
|
|
can be found at
|
|
<A HREF="https://www.kernel.org/doc/man-pages/.">https://www.kernel.org/doc/man-pages/.</A>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="192"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="193"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="194"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="195"><A HREF="#lbAE">RETURN VALUE</A><DD>
|
|
<DT id="196"><A HREF="#lbAF">ERRORS</A><DD>
|
|
<DT id="197"><A HREF="#lbAG">VERSIONS</A><DD>
|
|
<DT id="198"><A HREF="#lbAH">CONFORMING TO</A><DD>
|
|
<DT id="199"><A HREF="#lbAI">SEE ALSO</A><DD>
|
|
<DT id="200"><A HREF="#lbAJ">COLOPHON</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:33 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|