aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlejandro Colomar <alx@kernel.org>2024-07-10 22:15:25 +0200
committerAlejandro Colomar <alx@kernel.org>2024-08-21 23:51:07 +0200
commit0f9af1ade14f008a5596a656ead1a39130aa665e (patch)
treeb06ff116d4b82fb83e6d35e16b47745c5338658d
parentf0e457c0a89bc64d23b10b1e07b6eb46f742358e (diff)
downloadman-pages-0f9af1ade14f008a5596a656ead1a39130aa665e.tar.gz
KEYCTL_SETPERM.2const: Tweak after split
Signed-off-by: Alejandro Colomar <alx@kernel.org>
-rw-r--r--man/man2const/KEYCTL_SETPERM.2const189
1 files changed, 103 insertions, 86 deletions
diff --git a/man/man2const/KEYCTL_SETPERM.2const b/man/man2const/KEYCTL_SETPERM.2const
index 4ee23f6948..ef30f98e56 100644
--- a/man/man2const/KEYCTL_SETPERM.2const
+++ b/man/man2const/KEYCTL_SETPERM.2const
@@ -20,26 +20,22 @@ Standard C library
.BR "#include <sys/syscall.h>" " /* Definition of " SYS_* " constants */"
.B #include <unistd.h>
.P
-.BI "long syscall(SYS_keyctl, int " operation ", unsigned long " arg2 ,
-.BI " unsigned long " arg3 );
+.BI "long syscall(SYS_keyctl, KEYCTL_SETPERM, key_serial_t " key ,
+.BI " key_perm_t " perms );
.fi
.SH DESCRIPTION
-.TP
-.BR KEYCTL_SETPERM " (since Linux 2.6.10)"
Change the permissions of the key with the ID provided in the
-.I arg2
-argument (cast to
-.IR key_serial_t )
+.I key
+argument
to the permissions provided in the
-.I arg3
-argument (cast to
-.IR key_perm_t ).
-.IP
+.I perms
+argument.
+.P
If the caller doesn't have the
.B CAP_SYS_ADMIN
capability, it can change permissions only for the keys it owns.
(More precisely: the caller's filesystem UID must match the UID of the key.)
-.IP
+.P
The key must grant
.I setattr
permission to the caller
@@ -47,12 +43,11 @@ permission to the caller
of the caller's capabilities.
.\" FIXME Above, is it really intended that a privileged process can't
.\" override the lack of the 'setattr' permission?
-.IP
+.P
The permissions in
-.I arg3
+.I perms
specify masks of available operations
for each of the following user categories:
-.RS
.TP
.IR possessor " (since Linux 2.6.14)"
.\" commit 664cceb0093b755739e56572b836a99104ee8a75
@@ -77,14 +72,14 @@ that do not match the
and
.I group
categories.
-.RE
-.IP
+.P
The
.IR user ,
.IR group ,
and
.I other
-categories are exclusive: if a process matches the
+categories are exclusive:
+if a process matches the
.I user
category, it will not receive permissions granted in the
.I group
@@ -95,7 +90,7 @@ or
category, then it will not receive permissions granted in the
.I other
category.
-.IP
+.P
The
.I possessor
category grants permissions that are cumulative with the grants from the
@@ -104,39 +99,48 @@ category grants permissions that are cumulative with the grants from the
or
.I other
category.
-.IP
+.P
Each permission mask is eight bits in size,
with only six bits currently used.
The available permissions are:
-.RS
.TP
.I view
This permission allows reading attributes of a key.
.IP
This permission is required for the
-.B KEYCTL_DESCRIBE
+.BR KEYCTL_DESCRIBE (2const)
operation.
-.IP
-The permission bits for each category are
-.BR KEY_POS_VIEW ,
-.BR KEY_USR_VIEW ,
-.BR KEY_GRP_VIEW ,
-and
-.BR KEY_OTH_VIEW .
+.P
+The permission bits for each category are:
+.RS
+.TP
+.B KEY_POS_VIEW
+.TQ
+.B KEY_USR_VIEW
+.TQ
+.B KEY_GRP_VIEW
+.TQ
+.B KEY_OTH_VIEW
+.RE
.TP
.I read
This permission allows reading a key's payload.
.IP
This permission is required for the
-.B KEYCTL_READ
+.BR KEYCTL_READ (2const)
operation.
.IP
The permission bits for each category are
-.BR KEY_POS_READ ,
-.BR KEY_USR_READ ,
-.BR KEY_GRP_READ ,
-and
-.BR KEY_OTH_READ .
+.RS
+.TP
+.B KEY_POS_READ
+.TQ
+.B KEY_USR_READ
+.TQ
+.B KEY_GRP_READ
+.TQ
+.B KEY_OTH_READ
+.RE
.TP
.I write
This permission allows update or instantiation of a key's payload.
@@ -145,18 +149,23 @@ For a keyring, it allows keys to be linked and unlinked from the keyring,
This permission is required for the
.BR KEYCTL_UPDATE (2const),
.BR KEYCTL_REVOKE (2const),
-.BR KEYCTL_CLEAR ,
-.BR KEYCTL_LINK ,
+.BR KEYCTL_CLEAR (2const),
+.BR KEYCTL_LINK (2const),
and
-.B KEYCTL_UNLINK
+.BR KEYCTL_UNLINK (2const)
operations.
.IP
-The permission bits for each category are
-.BR KEY_POS_WRITE ,
-.BR KEY_USR_WRITE ,
-.BR KEY_GRP_WRITE ,
-and
-.BR KEY_OTH_WRITE .
+The permission bits for each category are:
+.RS
+.TP
+.B KEY_POS_WRITE
+.TQ
+.B KEY_USR_WRITE
+.TQ
+.B KEY_GRP_WRITE
+.TQ
+.B KEY_OTH_WRITE
+.RE
.TP
.I search
This permission allows keyrings to be searched and keys to be found.
@@ -167,70 +176,78 @@ permission set.
This permission is required for the
.BR KEYCTL_GET_KEYRING_ID (2const),
.BR KEYCTL_JOIN_SESSION_KEYRING (2const),
-.BR KEYCTL_SEARCH ,
+.BR KEYCTL_SEARCH (2const),
and
-.B KEYCTL_INVALIDATE
+.B KEYCTL_INVALIDATE (2const)
operations.
.IP
-The permission bits for each category are
-.BR KEY_POS_SEARCH ,
-.BR KEY_USR_SEARCH ,
-.BR KEY_GRP_SEARCH ,
-and
-.BR KEY_OTH_SEARCH .
+The permission bits for each category are:
+.RS
+.TP
+.B KEY_POS_SEARCH
+.TQ
+.B KEY_USR_SEARCH
+.TQ
+.B KEY_GRP_SEARCH
+.TQ
+.B KEY_OTH_SEARCH
+.RE
.TP
.I link
This permission allows a key or keyring to be linked to.
.IP
This permission is required for the
-.B KEYCTL_LINK
+.BR KEYCTL_LINK (2const)
and
-.B KEYCTL_SESSION_TO_PARENT
+.BR KEYCTL_SESSION_TO_PARENT (2const)
operations.
.IP
-The permission bits for each category are
-.BR KEY_POS_LINK ,
-.BR KEY_USR_LINK ,
-.BR KEY_GRP_LINK ,
-and
-.BR KEY_OTH_LINK .
+The permission bits for each category are:
+.RS
+.TP
+.B KEY_POS_LINK
+.TQ
+.B KEY_USR_LINK
+.TQ
+.B KEY_GRP_LINK
+.TQ
+.B KEY_OTH_LINK
+.RE
.TP
-.IR setattr " (since Linux 2.6.15)."
+.IR setattr " (since Linux 2.6.15)"
This permission allows a key's UID, GID, and permissions mask to be changed.
.IP
This permission is required for the
.BR KEYCTL_REVOKE (2const),
.BR KEYCTL_CHOWN (2const),
and
-.B KEYCTL_SETPERM
+.B KEYCTL_SETPERM (2const)
operations.
.IP
-The permission bits for each category are
-.BR KEY_POS_SETATTR ,
-.BR KEY_USR_SETATTR ,
-.BR KEY_GRP_SETATTR ,
-and
-.BR KEY_OTH_SETATTR .
+The permission bits for each category are:
+.RS
+.TP
+.B KEY_POS_SETATTR
+.TQ
+.B KEY_USR_SETATTR
+.TQ
+.B KEY_GRP_SETATTR
+.TQ
+.B KEY_OTH_SETATTR
.RE
-.IP
+.P
As a convenience, the following macros are defined as masks for
all of the permission bits in each of the user categories:
-.BR KEY_POS_ALL ,
-.BR KEY_USR_ALL ,
-.BR KEY_GRP_ALL ,
-and
-.BR KEY_OTH_ALL .
-.IP
-The
-.I arg4
-and
-.I arg5
-arguments are ignored.
-.IP
-This operation is exposed by
-.I libkeyutils
-via the function
-.BR keyctl_setperm (3).
+.RS
+.TP
+.B KEY_POS_ALL
+.TQ
+.B KEY_USR_ALL
+.TQ
+.B KEY_GRP_ALL
+.TQ
+.B KEY_OTH_ALL
+.RE
.SH RETURN VALUE
On success,
0 is returned.
@@ -245,7 +262,7 @@ is set to indicate the error.
was
.B KEYCTL_SETPERM
and an invalid permission bit was specified in
-.IR arg3 .
+.IR perms .
.SH VERSIONS
A wrapper is provided in the
.I libkeyutils