settrustee(8)

NAME

settrustee - set the new priviliges from trustee.conf

SYNOPSIS

settrustee <options>

OPTIONS

-f <trustee info file name> see fromat below. Default /etc/trustee.conf.

-s

<syscall> use syscall

-D

delete all trustees from the kernel and exit

-d

delete all trustees from the kernel before processing the trustees in the file

-p prefix to file names

File format:

A set of string like:

[block_device_name]/path/path:user_name:DCRWBE:+group_name:OtherChars

{network_name}/path/path:user_name:DCRWBE:+group_name:OtherChars

The string is started from the file (or directory) name. Double // is not allowed The next field is user name (* means everybody) or + followed by group name The next field is trustee mask. Possible chars DCRWBEUX mean:

R

- Read files permission

W

- Write permission

B

- Browse (like execute permission for directories)

E

- rEad diriectories

X

- eXecute (files, granted only if owner can execute the file

U

- use Unix permission system (set as default for /)

D

- deny the permissions in mask

C

- clear the permissions in mask

O

- only the directory and files in it (not subdirectories) affected by the trustee

!

- All except user (group) affected by the trustee

The access to a file ( directory) calculated on the following manner: the to masks - the first one for allow permission and the second one for deny. The first initially equals to [U], the second - to []. The path to the file (real path, not symbolic link) is analazied from the root directorry. If applicablee trustee is found, the approciate mask is ORed (or & ~(trustee mask) if C is set) to the mask in trustee. Access: given to superusers. Denied if deny flag set for at least one of the modes requested. Allowed if U flag is set, deny U flag is not set and unix permission is allow the access. Allow if all flags for requested mode are set. Denied otherwise. Known limitations: trustee system do not affect ioctl calls.

AUTHOR

This manual page was written by Piotr Roszatycki <[email protected]>, for the Debian GNU/Linux system (but may be used by others).