Manual Reference Pages - FS_SETCELL (1)
fs_setcell - Configures permissions for setuid programs from specified cells
fs setcell -cell <cell name>+ [-suid] [-nosuid] [-help]
fs setce -c <cell name>+ [-s] [-n] [-h]
The fs setcell command sets whether the Cache Manager allows programs
(and other executable files) from each cell named by the -cell argument
to run with setuid permission. By default, the Cache Manager allows
programs from its home cell to run with setuid permission, but not
programs from any foreign cells. A program belongs to the same cell as the
file server machine that houses the volume in which the programs binary
file resides, as specified in the file server machines
/usr/local/etc/openafs/server/ThisCell file. The Cache Manager determines its own home
cell by reading the /usr/local/etc/openafs/ThisCell file at initialization.
To enable programs from each specified cell to run with setuid permission,
include the -suid flag. To prohibit programs from running with setuid
permission, include the -nosuid flag, or omit both flags.
The fs setcell command directly alters a cells setuid status as
recorded in kernel memory, so rebooting the machine is unnecessary.
However, non-default settings do not persist across reboots of the machine
unless the appropriate fs setcell command appears in the machines AFS
To display a cells setuid status, issue the fs getcellstatus command.
AFS does not recognize effective UID: if a setuid program accesses AFS
files and directories, it does so using the current AFS identity of the
AFS user who initialized the program, not of the programs owner. Only
the local file system recognizes effective UID.
Only members of the system:administrators group can turn on the setuid
mode bit on an AFS file or directory.
When the setuid mode bit is turned on, the UNIX ls -l command displays
the third user mode bit as an s instead of an x. However, the s
does not appear on an AFS file or directory unless setuid permission is
enabled for the cell in which the file resides.
-cell <cell name>+
Names each cell for which to set setuid status. Provide the fully
qualified domain name, or a shortened form that disambiguates it from the
other cells listed in the local /usr/local/etc/openafs/CellServDB file.
Allows programs from each specified cell to run with setuid
privilege. Provide it or the -nosuid flag, or omit both flags to
disallow programs from running with setuid privilege.
Prevents programs from each specified cell from running with setuid
privilege. Provide it or the -suid flag, or omit both flags to disallow
programs form running with setuid privilege.
Prints the online help for this command. All other valid options are
The following command enables executable files from the State University
cell to run with setuid privilege on the local machine:
% fs setcell -cell stateu.edu -suid
The issuer must be logged in as the local superuser root.
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
This documentation is covered by the IBM Public License Version 1.0. It was
converted from HTML to POD by software written by Chas Williams and Russ
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|OpenAFS ||FS_SETCELL (1) ||2015-10-28 |
Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.