bionic (1) setpriv.1.gz

NAME

       setpriv - run a program with different Linux privilege settings

SYNOPSIS

       setpriv [options] program [arguments]

DESCRIPTION

       Sets or queries various Linux privilege settings that are inherited across execve(2).

       The  difference  between  the  commands setpriv and su (or runuser) is that setpriv does not use open PAM
       session and does not ask for password.  It's simple non-set-user-ID wrapper around execve system call.

OPTION

       --clear-groups
              Clear supplementary groups.

       -d, --dump
              Dump current privilege state.  Can be specified more than once  to  show  extra,  mostly  useless,
              information.  Incompatible with all other options.

       --groups group...
              Set supplementary groups.  The argument is a comma-separated list.

       --inh-caps (+|-)cap...  or  --ambient-caps (+|-)cap...  or  --bounding-set (+|-)cap...
              Set  the  inheritable  capabilities,  ambient  capabilities  or  the capability bounding set.  See
              capabilities(7).  The argument is a comma-separated list of +cap and -cap entries,  which  add  or
              remove  an  entry respectively. cap can either be a human-readable name as seen in capabilities(7)
              without the cap_ prefix or of the format cap_N, where N is the internal capability index  used  by
              Linux.   +all  and -all can be used to add or remove all caps.  The set of capabilities starts out
              as the current inheritable set for --inh-caps, the current ambient set for --ambient-caps and  the
              current bounding set for --bounding-set.  If you drop something from the bounding set without also
              dropping it from the inheritable set, you are likely to become confused.  Do not do that.

       --keep-groups
              Preserve supplementary groups.  Only useful in conjunction with --rgid, --egid, or --regid.

       --init-groups
              Initialize supplementary groups using initgroups(3).  Only useful in conjunction  with  --ruid  or
              --reuid.

       --list-caps
              List all known capabilities.  This option must be specified alone.

       --no-new-privs
              Set  the  no_new_privs  bit.   With  this  bit  set, execve(2) will not grant new privileges.  For
              example, the set-user-ID and set-group-ID bits as well as  file  capabilities  will  be  disabled.
              (Executing  binaries  with  these  bits  set  will  still work, but they will not gain privileges.
              Certain LSMs, especially AppArmor, may result in failures to execute certain programs.)  This  bit
              is inherited by child processes and cannot be unset.  See prctl(2) and Documentation/prctl/no_new_
              privs.txt in the Linux kernel source.

              The no_new_privs bit is supported since Linux 3.5.

       --rgid gid, --egid gid, --regid gid
              Set the real, effective, or both GIDs.  The gid argument can be given as textual group name.

              For safety, you must specify one of --clear-groups, --groups, or  --keep-groups  if  you  set  any
              primary gid.

       --ruid uid, --euid uid, --reuid uid
              Set the real, effective, or both UIDs.  The uid argument can be given as textual login name.

              Setting  a uid or gid does not change capabilities, although the exec call at the end might change
              capabilities.  This means that, if you are root, you probably want to do something like:

                      setpriv --reuid=1000 --regid=1000 --caps=-all

       --securebits (+|-)securebit...
              Set or clear securebits.  The argument is  a  comma-separated  list.   The  valid  securebits  are
              noroot,  noroot_locked,  no_setuid_fixup, no_setuid_fixup_locked, and keep_caps_locked.  keep_caps
              is cleared by execve(2) and is therefore not allowed.

       --selinux-label label
              Request a particular SELinux transition (using a transition on exec,  not  dyntrans).   This  will
              fail  and cause setpriv(1) to abort if SELinux is not in use, and the transition may be ignored or
              cause execve(2) to fail  at  SELinux's  whim.   (In  particular,  this  is  unlikely  to  work  in
              conjunction with no_new_privs.)  This is similar to runcon(1).

       --apparmor-profile profile
              Request  a  particular  AppArmor  profile  (using a transition on exec).  This will fail and cause
              setpriv(1) to abort if AppArmor is not in  use,  and  the  transition  may  be  ignored  or  cause
              execve(2) to fail at AppArmor's whim.

       -V, --version
              Display version information and exit.

       -h, --help
              Display help text and exit.

NOTES

       If  applying  any  specified option fails, program will not be run and setpriv will return with exit code
       127.

       Be careful with this tool --  it  may  have  unexpected  security  consequences.   For  example,  setting
       no_new_privs  and then execing a program that is SELinux-confined (as this tool would do) may prevent the
       SELinux restrictions from taking effect.

SEE ALSO

       runuser(1), su(1), prctl(2), capabilities(7)

AUTHOR

       Andy Lutomirski ⟨luto@amacapital.net⟩

AVAILABILITY

       The setpriv command is part of the  util-linux  package  and  is  available  from  Linux  Kernel  Archive
       ⟨https://www.kernel.org/pub/linux/utils/util-linux/⟩.