1 .\" Copyright (c) 1995 David Nugent <davidn@blaze.net.au>
2 .\" All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, is permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice immediately at the beginning of the file, without modification,
9 .\" this list of conditions, and the following disclaimer.
10 .\" 2. Redistributions in binary form must reproduce the above copyright
11 .\" notice, this list of conditions and the following disclaimer in the
12 .\" documentation and/or other materials provided with the distribution.
13 .\" 3. This work was done expressly for inclusion into FreeBSD. Other use
14 .\" is permitted provided this notation is included.
15 .\" 4. Absolutely no warranty of function or purpose is made by the author
17 .\" 5. Modifications may be freely made to this file providing the above
18 .\" conditions are met.
26 .Nm setclassenvironment ,
27 .Nm setclassresources ,
29 .Nd "functions for using the login class capabilities database"
36 .Fn setclasscontext "const char *classname" "unsigned int flags"
38 .Fn setclasscpumask "login_cap_t *lc"
40 .Fn setclassenvironment "login_cap_t *lc" "const struct passwd *pwd" "int paths"
42 .Fn setclassresources "login_cap_t *lc"
44 .Fn setusercontext "login_cap_t *lc" "const struct passwd *pwd" "uid_t uid" "unsigned int flags"
46 These functions provide a higher level interface to the login class
47 database than those documented in
49 These functions are used to set resource limits, environment and
50 accounting settings for users on logging into the system and when
51 selecting an appropriate set of environment and resource settings
52 for system daemons based on login classes.
53 These functions may only be called if the current process is
54 running with root privileges.
55 If the LOGIN_SETLOGIN flag is used this function calls
57 and due care must be taken as detailed in the manpage for that
58 function and this affects all processes running in the same session
59 and not just the current process.
63 function sets various class context values (resource limits, umask and
64 process priorities) based on values for a specific named class.
68 function sets class context values based on a given login_cap_t
69 object and a specific passwd record (if login_cap_t is NULL),
70 the current session's login, and the current process
71 user and group ownership.
72 Each of these actions is selectable via bit-flags passed
75 parameter, which is comprised of one or more of the following:
76 .Bl -tag -width LOGIN_SETLOGINCLASS
78 Set the login associated with the current session to the user
79 specified in the passwd structure using
83 parameter must not be NULL if this option is used.
85 Set ownership of the current process to the uid specified in the
90 Set group ownership of the current process to the group id
91 specified in the passwd structure using
95 to set up the group access list for the current process.
98 parameter must not be NULL if this option is used.
99 .It LOGIN_SETRESOURCES
100 Set resource limits for the current process based on values
101 specified in the system login class database.
102 Class capability tags used, with and without -cur (soft limit)
103 or -max (hard limit) suffixes and the corresponding resource
107 filesize RLIMIT_FSIZE
109 stacksize RLIMIT_STACK
110 coredumpsize RLIMIT_CORE
112 memorylocked RLIMIT_MEMLOCK
114 openfiles RLIMIT_NOFILE
116 vmemoryuse RLIMIT_VMEM
117 pseudoterminals RLIMIT_NPTS
119 kqueues RLIMIT_KQUEUES
122 .It LOGIN_SETPRIORITY
123 Set the scheduling priority for the current process based on the
124 value specified in the system login class database.
125 Class capability tags used:
130 Set the umask for the current process to a value in the user or
131 system login class database.
132 Class capability tags used:
137 Set the "path" and "manpath" environment variables based on values
138 in the user or system login class database.
139 Class capability tags used with the corresponding environment
146 Set various environment variables based on values in the user or
147 system login class database.
148 Class capability tags used with the corresponding environment
157 Additional environment variables may be set using the list type
158 capability "setenv=var1 val1,var2 val2..,varN valN".
160 Set the MAC label for the current process to the label specified
161 in system login class database.
165 and set the cpu affinity to the specified mask.
166 The string may contain a comma separated list of numbers and/or number
167 ranges as handled by the
169 utility or the case-insensitive string
173 no action will be taken.
174 .It LOGIN_SETLOGINCLASS
175 Set the login class of the current process using
176 .Xr setloginclass 2 .
178 Enables all of the above settings.
181 Note that when setting environment variables and a valid passwd
182 pointer is provided in the
184 parameter, the characters
188 are substituted for the user's home directory and login name
192 .Fn setclasscpumask ,
193 .Fn setclassresources
195 .Fn setclassenvironment
196 functions are subsets of the setcontext functions above, but may
197 be useful in isolation.
203 functions return -1 if an error occurred, or 0 on success.
204 If an error occurs when attempting to set the user, login, group
205 or resources, a message is reported to
207 with LOG_ERR priority and directed to the currently active facility.
214 .Xr setloginclass 2 ,
224 .Fn setclasscontext ,
225 .Fn setclasscpumask ,
226 .Fn setclassenvironment ,
227 .Fn setclassresources