memusage.1, memusagestat.1, pldd.1, accept.2, adjtimex.2, arch_prctl.2, bdflush.2...

[thirdparty/man-pages.git] / man2 / setuid.2

diff --git a/man2/setuid.2 b/man2/setuid.2
index 96cd591ec322fe38da7e065dd396cb274ac7a348..d32a63ba10455af79695762f22eed1d3aa0edb65 100644 (file)
--- a/man2/setuid.2
+++ b/man2/setuid.2
@@ -1,5 +1,7 @@
 .\" Copyright (C), 1994, Graeme W. Wilford (Wilf).
+.\" and Copyright (C) 2010, 2014, 2015, Michael Kerrisk <mtk.manpages@gmail.com>
 .\"
+.\" %%%LICENSE_START(VERBATIM)
 .\" Permission is granted to make and distribute verbatim copies of this
 .\" manual provided the copyright notice and this permission notice are
 .\" preserved on all copies.
@@ -19,13 +21,14 @@
 .\"
 .\" Formatted or processed versions of this manual, if unaccompanied by
 .\" the source, must acknowledge the copyright and authors of this work.
+.\" %%%LICENSE_END
 .\"
 .\" Fri Jul 29th 12:56:44 BST 1994  Wilf. <G.Wilford@ee.surrey.ac.uk>
 .\" Changes inspired by patch from Richard Kettlewell
 .\"   <richard@greenend.org.uk>, aeb 970616.
 .\" Modified, 27 May 2004, Michael Kerrisk <mtk.manpages@gmail.com>
 .\"     Added notes on capability requirements
-.TH SETUID 2 2010-11-22 "Linux" "Linux Programmer's Manual"
+.TH SETUID 2 2016-10-08 "Linux" "Linux Programmer's Manual"
 .SH NAME
 setuid \- set user identity
 .SH SYNOPSIS
@@ -37,7 +40,10 @@ setuid \- set user identity
 .SH DESCRIPTION
 .BR setuid ()
 sets the effective user ID of the calling process.
-If the effective UID of the caller is root,
+If the calling process is privileged
+(more precisely: if the process has the
+.BR CAP_SETUID
+capability in its user namespace),
 the real UID and saved set-user-ID are also set.
 .PP
 Under Linux,
@@ -65,21 +71,46 @@ root privileges afterward cannot use
 .BR setuid ().
 You can accomplish this with
 .BR seteuid (2).
-.SH "RETURN VALUE"
+.SH RETURN VALUE
 On success, zero is returned.
 On error, \-1 is returned, and
 .I errno
 is set appropriately.
+
+.IR Note :
+there are cases where
+.BR setuid ()
+can fail even when the caller is UID 0;
+it is a grave security error to omit checking for a failure return from
+.BR setuid ().
 .SH ERRORS
 .TP
 .B EAGAIN
-The
+The call would change the caller's real UID (i.e.,
+.I uid
+does not match the caller's real UID),
+but there was a temporary failure allocating the
+necessary kernel data structures.
+.TP
+.B EAGAIN
 .I uid
-does not match the current uid and
+does not match the real user ID of the caller and this call would
+bring the number of processes belonging to the real user ID
 .I uid
-brings process over its
+over the caller's
 .B RLIMIT_NPROC
 resource limit.
+Since Linux 3.1, this error case no longer occurs
+(but robust applications should check for this error);
+see the description of
+.B EAGAIN
+in
+.BR execve (2).
+.TP
+.B EINVAL
+The user ID specified in
+.I uid
+is not valid in this user namespace.
 .TP
 .B EPERM
 The user is not privileged (Linux: does not have the
@@ -87,18 +118,17 @@ The user is not privileged (Linux: does not have the
 capability) and
 .I uid
 does not match the real UID or saved set-user-ID of the calling process.
-.SH "CONFORMING TO"
-SVr4, POSIX.1-2001.
+.SH CONFORMING TO
+POSIX.1-2001, POSIX.1-2008, SVr4.
 Not quite compatible with the 4.4BSD call, which
 sets all of the real, saved, and effective user IDs.
 .\" SVr4 documents an additional EINVAL error condition.
 .SH NOTES
-.SS Linux Notes
-Linux has the concept of file system user ID, normally equal to the
+Linux has the concept of the filesystem user ID, normally equal to the
 effective user ID.
 The
 .BR setuid ()
-call also sets the file system user ID of the calling process.
+call also sets the filesystem user ID of the calling process.
 See
 .BR setfsuid (2).
 .PP
@@ -106,10 +136,36 @@ If
 .I uid
 is different from the old effective UID, the process will
 be forbidden from leaving core dumps.
-.SH "SEE ALSO"
+
+The original Linux
+.BR setuid ()
+system call supported only 16-bit user IDs.
+Subsequently, Linux 2.4 added
+.BR setuid32 ()
+supporting 32-bit IDs.
+The glibc
+.BR setuid ()
+wrapper function transparently deals with the variation across kernel versions.
+.\"
+.SS C library/kernel differences
+At the kernel level, user IDs and group IDs are a per-thread attribute.
+However, POSIX requires that all threads in a process
+share the same credentials.
+The NPTL threading implementation handles the POSIX requirements by
+providing wrapper functions for
+the various system calls that change process UIDs and GIDs.
+These wrapper functions (including the one for
+.BR setuid ())
+employ a signal-based technique to ensure
+that when one thread changes credentials,
+all of the other threads in the process also change their credentials.
+For details, see
+.BR nptl (7).
+.SH SEE ALSO
 .BR getuid (2),
 .BR seteuid (2),
 .BR setfsuid (2),
 .BR setreuid (2),
 .BR capabilities (7),
-.BR credentials (7)
+.BR credentials (7),
+.BR user_namespaces (7)