189 lines
5.0 KiB
HTML
189 lines
5.0 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of SETFSGID</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>SETFSGID</H1>
|
|
Section: Linux Programmer's Manual (2)<BR>Updated: 2019-05-09<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
setfsgid - set group identity used for filesystem checks
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>#include <<A HREF="file:///usr/include/sys/fsuid.h">sys/fsuid.h</A>></B>
|
|
|
|
<P>
|
|
|
|
<B>int setfsgid(uid_t </B><I>fsgid</I><B>);</B>
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
On Linux, a process has both a filesystem group ID and an effective group ID.
|
|
The (Linux-specific) filesystem group ID is used
|
|
for permissions checking when accessing filesystem objects,
|
|
while the effective group ID is used for some other kinds
|
|
of permissions checks (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+credentials">credentials</A></B>(7)).
|
|
|
|
<P>
|
|
|
|
Normally, the value of the process's filesystem group ID
|
|
is the same as the value of its effective group ID.
|
|
This is so, because whenever a process's effective group ID is changed,
|
|
the kernel also changes the filesystem group ID to be the same as
|
|
the new value of the effective group ID.
|
|
A process can cause the value of its filesystem group ID to diverge
|
|
from its effective group ID by using
|
|
<B>setfsgid</B>()
|
|
|
|
to change its filesystem group ID to the value given in
|
|
<I>fsgid</I>.
|
|
|
|
<P>
|
|
|
|
<B>setfsgid</B>()
|
|
|
|
will succeed only if the caller is the superuser or if
|
|
<I>fsgid</I>
|
|
|
|
matches either the caller's real group ID, effective group ID,
|
|
saved set-group-ID, or current the filesystem user ID.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>RETURN VALUE</H2>
|
|
|
|
On both success and failure,
|
|
this call returns the previous filesystem group ID of the caller.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>VERSIONS</H2>
|
|
|
|
This system call is present in Linux since version 1.2.
|
|
|
|
|
|
<A NAME="lbAG"> </A>
|
|
<H2>CONFORMING TO</H2>
|
|
|
|
<B>setfsgid</B>()
|
|
|
|
is Linux-specific and should not be used in programs intended
|
|
to be portable.
|
|
<A NAME="lbAH"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
The filesystem group ID concept and the
|
|
<B>setfsgid</B>()
|
|
|
|
system call were invented for historical reasons that are
|
|
no longer applicable on modern Linux kernels.
|
|
See
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setfsuid">setfsuid</A></B>(2)
|
|
|
|
for a discussion of why the use of both
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setfsuid">setfsuid</A></B>(2)
|
|
|
|
and
|
|
<B>setfsgid</B>()
|
|
|
|
is nowadays unneeded.
|
|
<P>
|
|
|
|
The original Linux
|
|
<B>setfsgid</B>()
|
|
|
|
system call supported only 16-bit group IDs.
|
|
Subsequently, Linux 2.4 added
|
|
<B>setfsgid32</B>()
|
|
|
|
supporting 32-bit IDs.
|
|
The glibc
|
|
<B>setfsgid</B>()
|
|
|
|
wrapper function transparently deals with the variation across kernel versions.
|
|
<A NAME="lbAI"> </A>
|
|
<H3>C library/kernel differences</H3>
|
|
|
|
In glibc 2.15 and earlier,
|
|
when the wrapper for this system call determines that the argument can't be
|
|
passed to the kernel without integer truncation (because the kernel
|
|
is old and does not support 32-bit group IDs),
|
|
it will return -1 and set <I>errno</I> to
|
|
<B>EINVAL</B>
|
|
|
|
without attempting
|
|
the system call.
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
No error indications of any kind are returned to the caller,
|
|
and the fact that both successful and unsuccessful calls return
|
|
the same value makes it impossible to directly determine
|
|
whether the call succeeded or failed.
|
|
Instead, the caller must resort to looking at the return value
|
|
from a further call such as
|
|
<I>setfsgid(-1)</I>
|
|
|
|
(which will always fail), in order to determine if a preceding call to
|
|
<B>setfsgid</B>()
|
|
|
|
changed the filesystem group ID.
|
|
At the very
|
|
least,
|
|
<B>EPERM</B>
|
|
|
|
should be returned when the call fails (because the caller lacks the
|
|
<B>CAP_SETGID</B>
|
|
|
|
capability).
|
|
<A NAME="lbAK"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+kill">kill</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setfsuid">setfsuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+credentials">credentials</A></B>(7)
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H2>COLOPHON</H2>
|
|
|
|
This page is part of release 5.05 of the Linux
|
|
<I>man-pages</I>
|
|
|
|
project.
|
|
A description of the project,
|
|
information about reporting bugs,
|
|
and the latest version of this page,
|
|
can be found at
|
|
<A HREF="https://www.kernel.org/doc/man-pages/.">https://www.kernel.org/doc/man-pages/.</A>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="1"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="2"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="3"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="4"><A HREF="#lbAE">RETURN VALUE</A><DD>
|
|
<DT id="5"><A HREF="#lbAF">VERSIONS</A><DD>
|
|
<DT id="6"><A HREF="#lbAG">CONFORMING TO</A><DD>
|
|
<DT id="7"><A HREF="#lbAH">NOTES</A><DD>
|
|
<DL>
|
|
<DT id="8"><A HREF="#lbAI">C library/kernel differences</A><DD>
|
|
</DL>
|
|
<DT id="9"><A HREF="#lbAJ">BUGS</A><DD>
|
|
<DT id="10"><A HREF="#lbAK">SEE ALSO</A><DD>
|
|
<DT id="11"><A HREF="#lbAL">COLOPHON</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:34 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|