newuidmap,newgidmap: New suid helpers for using subordinate uids and gids
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
This commit is contained in:
Eric W. Biederman
committed by
Serge Hallyn
Serge Hallyn
parent
2cffa14105
commit
673c2a6f9a
@@ -30,7 +30,9 @@ man_MANS = \
|
||||
man1/login.1 \
|
||||
man5/login.defs.5 \
|
||||
man8/logoutd.8 \
|
||||
man1/newgidmap.1 \
|
||||
man1/newgrp.1 \
|
||||
man1/newuidmap.1 \
|
||||
man8/newusers.8 \
|
||||
man8/nologin.8 \
|
||||
man1/passwd.1 \
|
||||
@@ -83,7 +85,9 @@ man_XMANS = \
|
||||
login.access.5.xml \
|
||||
login.defs.5.xml \
|
||||
logoutd.8.xml \
|
||||
newgidmap.1.xml \
|
||||
newgrp.1.xml \
|
||||
newuidmap.1.xml \
|
||||
newusers.8.xml \
|
||||
nologin.8.xml \
|
||||
passwd.1.xml \
|
||||
|
||||
157
man/newgidmap.1.xml
Normal file
157
man/newgidmap.1.xml
Normal file
@@ -0,0 +1,157 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
Copyright (c) 2013 Eric W. Biederman
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
1. Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
2. Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
3. The name of the copyright holders or contributors may not be used to
|
||||
endorse or promote products derived from this software without
|
||||
specific prior written permission.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
-->
|
||||
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
|
||||
<!-- SHADOW-CONFIG-HERE -->
|
||||
]>
|
||||
|
||||
<refentry id='newgidmap.1'>
|
||||
<refmeta>
|
||||
<refentrytitle>newgidmap</refentrytitle>
|
||||
<manvolnum>1</manvolnum>
|
||||
<refmiscinfo class="sectdesc">User Commands</refmiscinfo>
|
||||
<refmiscinfo class="source">shadow-utils</refmiscinfo>
|
||||
<refmiscinfo class="version">&SHADOW_UTILS_VERSION;</refmiscinfo>
|
||||
</refmeta>
|
||||
<refnamediv id='name'>
|
||||
<refname>newgidmap</refname>
|
||||
<refpurpose>set the gid mapping of a user namespace</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
<refsynopsisdiv id='synopsis'>
|
||||
<cmdsynopsis>
|
||||
<command>newgidmap</command>
|
||||
<arg choice='plain'>
|
||||
<replaceable>pid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>gid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>lowergid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>count</replaceable>
|
||||
</arg>
|
||||
<arg choice='opt'>
|
||||
<arg choice='plain'>
|
||||
<replaceable>pid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>gid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>lowergid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>count</replaceable>
|
||||
</arg>
|
||||
<arg choice='opt'>
|
||||
<replaceable>...</replaceable>
|
||||
</arg>
|
||||
</arg>
|
||||
</cmdsynopsis>
|
||||
</refsynopsisdiv>
|
||||
|
||||
<refsect1 id='description'>
|
||||
<title>DESCRIPTION</title>
|
||||
<para>
|
||||
The <command>newgidmap</command> sets <filename>/proc/[pid]/gid_map</filename> based on it's
|
||||
command line arguments and the gids allowed in <filename>/etc/subgid</filename>.
|
||||
</para>
|
||||
|
||||
</refsect1>
|
||||
|
||||
<refsect1 id='options'>
|
||||
<title>OPTIONS</title>
|
||||
<para>
|
||||
There currently are no options to the <command>newgidmap</command> command.
|
||||
</para>
|
||||
<variablelist remap='IP'>
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
<refsect1 id='note'>
|
||||
<title>NOTE</title>
|
||||
<para>
|
||||
The only restriction placed on the login shell is that the command
|
||||
name must be listed in <filename>/etc/shells</filename>, unless the
|
||||
invoker is the superuser, and then any value may be added. An
|
||||
account with a restricted login shell may not change her login shell.
|
||||
For this reason, placing <filename>/bin/rsh</filename> in
|
||||
<filename>/etc/shells</filename> is discouraged since accidentally
|
||||
changing to a restricted shell would prevent the user from ever
|
||||
changing her login shell back to its original value.
|
||||
</para>
|
||||
</refsect1>
|
||||
|
||||
|
||||
<refsect1 id='files'>
|
||||
<title>FILES</title>
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term><filename>/etc/subgid</filename></term>
|
||||
<listitem>
|
||||
<para>List of users subordinate user IDs.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><filename>/proc/[pid]/gid_map</filename></term>
|
||||
<listitem>
|
||||
<para>Mapping of gids from one between user namespaces.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
<refsect1 id='see_also'>
|
||||
<title>SEE ALSO</title>
|
||||
<para>
|
||||
<citerefentry>
|
||||
<refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>useradd</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>usermod</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>newusers</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>userdel</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>subgid</refentrytitle><manvolnum>5</manvolnum>
|
||||
</citerefentry>.
|
||||
</para>
|
||||
</refsect1>
|
||||
</refentry>
|
||||
154
man/newuidmap.1.xml
Normal file
154
man/newuidmap.1.xml
Normal file
@@ -0,0 +1,154 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
Copyright (c) 2013 Eric W. Biederman
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
1. Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
2. Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
3. The name of the copyright holders or contributors may not be used to
|
||||
endorse or promote products derived from this software without
|
||||
specific prior written permission.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
-->
|
||||
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
|
||||
<!-- SHADOW-CONFIG-HERE -->
|
||||
]>
|
||||
|
||||
<refentry id='newuidmap.1'>
|
||||
<refmeta>
|
||||
<refentrytitle>newuidmap</refentrytitle>
|
||||
<manvolnum>1</manvolnum>
|
||||
<refmiscinfo class="sectdesc">User Commands</refmiscinfo>
|
||||
<refmiscinfo class="source">shadow-utils</refmiscinfo>
|
||||
<refmiscinfo class="version">&SHADOW_UTILS_VERSION;</refmiscinfo>
|
||||
</refmeta>
|
||||
<refnamediv id='name'>
|
||||
<refname>newuidmap</refname>
|
||||
<refpurpose>set the uid mapping of a user namespace</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
<refsynopsisdiv id='synopsis'>
|
||||
<cmdsynopsis>
|
||||
<command>newuidmap</command>
|
||||
<arg choice='plain'>
|
||||
<replaceable>pid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>uid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>loweruid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>count</replaceable>
|
||||
</arg>
|
||||
<arg choice='opt'>
|
||||
<arg choice='plain'>
|
||||
<replaceable>uid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>loweruid</replaceable>
|
||||
</arg>
|
||||
<arg choice='plain'>
|
||||
<replaceable>count</replaceable>
|
||||
</arg>
|
||||
<arg choice='opt'>
|
||||
<replaceable>...</replaceable>
|
||||
</arg>
|
||||
</arg>
|
||||
</cmdsynopsis>
|
||||
</refsynopsisdiv>
|
||||
|
||||
<refsect1 id='description'>
|
||||
<title>DESCRIPTION</title>
|
||||
<para>
|
||||
The <command>newuidmap</command> sets <filename>/proc/[pid]/uid_map</filename> based on it's
|
||||
command line arguments and the uids allowed in <filename>/etc/subuid</filename>.
|
||||
</para>
|
||||
|
||||
</refsect1>
|
||||
|
||||
<refsect1 id='options'>
|
||||
<title>OPTIONS</title>
|
||||
<para>
|
||||
There currently are no options to the <command>newuidmap</command> command.
|
||||
</para>
|
||||
<variablelist remap='IP'>
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
<refsect1 id='note'>
|
||||
<title>NOTE</title>
|
||||
<para>
|
||||
The only restriction placed on the login shell is that the command
|
||||
name must be listed in <filename>/etc/shells</filename>, unless the
|
||||
invoker is the superuser, and then any value may be added. An
|
||||
account with a restricted login shell may not change her login shell.
|
||||
For this reason, placing <filename>/bin/rsh</filename> in
|
||||
<filename>/etc/shells</filename> is discouraged since accidentally
|
||||
changing to a restricted shell would prevent the user from ever
|
||||
changing her login shell back to its original value.
|
||||
</para>
|
||||
</refsect1>
|
||||
|
||||
|
||||
<refsect1 id='files'>
|
||||
<title>FILES</title>
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term><filename>/etc/subuid</filename></term>
|
||||
<listitem>
|
||||
<para>List of users subordinate user IDs.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><filename>/proc/[pid]/uid_map</filename></term>
|
||||
<listitem>
|
||||
<para>Mapping of uids from one between user namespaces.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
<refsect1 id='see_also'>
|
||||
<title>SEE ALSO</title>
|
||||
<para>
|
||||
<citerefentry>
|
||||
<refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>useradd</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>usermod</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>newusers</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>userdel</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>subuid</refentrytitle><manvolnum>5</manvolnum>
|
||||
</citerefentry>.
|
||||
</para>
|
||||
</refsect1>
|
||||
</refentry>
|
||||
Reference in New Issue
Block a user