Provided by: freebsd-manpages_7.2-1_all
suser, suser_cred - check if credentials have superuser privileges
suser(struct thread *td);
suser_cred(struct ucred *cred, int flag);
The suser() and suser_cred() functions check if the credentials given
include superuser powers.
These interfaces have now been obsoleted by priv(9), and are provided
only for compatibility with third party kernel modules that have not yet
been updated to the new interface. They should not be used in any new
The suser() function is the most common, and should be used unless
special circumstances dictate otherwise.
The suser_cred() function should be used when the credentials to be
checked are not the thread’s own, when there is no thread, when superuser
powers should be extended to imprisoned roots, or when the credential to
be checked is the real user rather than the effective user.
Whether or not a privilege is permitted in a jail(8) depends on logic in
In general, privileges are assigned based on the effective user ID; in
some cases, the real user ID may be used.
The flags field is currently unused.
The suser() and suser_cred() functions note the fact that superuser
powers have been used in the process structure of the process specified.
Because part of their function is to notice whether superuser powers have
been used, the functions should only be called after other permission
possibilities have been exhausted.
The suser() and suser_cred() functions return 0 if the user has superuser
powers and EPERM otherwise. This is the reverse logic of some other
implementations of suser() in which a TRUE response indicates superuser
chroot(2), jail(2), priv(9)
The suser() and suser_cred() functions do not, in fact, record that
superuser privileges have been used, and have not done so since August