NAME

fs_setcell - Configures permissions for setuid programs from specified cells

SYNOPSIS

fs setcell -cell <cell name>+ [-suid] [-nosuid] [-config <configuration file>] [-help]

DESCRIPTION

The fs setcell command sets whether the Cache Manager allows programs (and other executable files) from each cell named by the -cell argument to run with setuid permission. By default, the Cache Manager disallows programs from any cell to run with setuid permission. A program belongs to the same cell as the file server machine that houses the volume in which the program's binary file resides.

To enable programs from each specified cell to run with setuid permission, include the -suid flag. To prohibit programs from running with setuid permission, include the -nosuid flag, or omit both flags.

The fs setcell command directly alters a cell's setuid status as recorded in kernel memory, so rebooting the machine is unnecessary. However, non-default settings do not persist across reboots of the machine unless the appropriate fs setcell command appears in the machine's AFS initialization file.

To display a cell's setuid status, issue the fs getcellstatus command.

CAUTIONS

AFS does not recognize effective UID: if a setuid program accesses AFS files and directories, it does so using the current AFS identity of the AFS user who initialized the program, not of the program's owner. Only the local file system recognizes effective UID.

Only members of the system:administrators group can turn on the setuid mode bit on an AFS file or directory.

When the setuid mode bit is turned on, the UNIX ls -l command displays the third user mode bit as an s instead of an x. However, the s does not appear on an AFS file or directory unless setuid permission is enabled for the cell in which the file resides.

OPTIONS

-cell <cell name>+

Names each cell for which to set setuid status. Provide the fully qualified domain name, or a shortened form that disambiguates it from the other cells listed in the local /etc/yfs/CellServDB file.

-suid

Allows programs from each specified cell to run with setuid privilege. Provide it or the -nosuid flag, or omit both flags to disallow programs from running with setuid privilege.

-nosuid

Prevents programs from each specified cell from running with setuid privilege. Provide it or the -suid flag, or omit both flags to disallow programs form running with setuid privilege.

-config <configuration file>

The location of the configuration file to be used. The default file name is yfs-client.conf and the default location is /etc/yfs. The dirpath settings in the configuration file can be used to specify an alternate location for the cell configuration information.

-help

Prints the online help for this command. All other valid options are ignored.

EXAMPLES

The following command enables executable files from the foreign-cell-name.com cell to run with setuid privilege on the local machine:

   % fs setcell -cell foreign-cell-name.com -suid

PRIVILEGE REQUIRED

The issuer must be logged in as the local superuser root.

SEE ALSO

fs_getcellstatus(1)

COPYRIGHT

IBM Corporation 2000. http://www.ibm.com/ All Rights Reserved.

This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.

ACKNOWLEDGEMENTS

"AFS" is a registered mark of International Business Machines Corporation, used under license. (USPTO Registration 1598389)

"OpenAFS" is a registered mark of International Business Machines Corporation. (USPTO Registration 4577045)

The "AuriStor" name, log 'S' brand mark, and icon are registered marks of AuriStor, Inc. (USPTO Registrations 4849419, 4849421, and 4928460) (EUIPO Registration 015539653).

"Your File System" is a registered mark of AuriStor, Inc. (USPTO Registrations 4801402 and 4849418).

"YFS" and "AuriStor File System" are trademarks of AuriStor, Inc.