fs_setcell(1) [osf1 man page]
FS_SETCELL(1) AFS Command Reference FS_SETCELL(1) NAME
fs_setcell - Configures permissions for setuid programs from specified cells SYNOPSIS
fs setcell -cell <cell name>+ [-suid] [-nosuid] [-help] fs setce -c <cell name>+ [-s] [-n] [-h] DESCRIPTION
The fs setcell command sets whether the Cache Manager allows programs (and other executable files) from each cell named by the -cell argument to run with setuid permission. By default, the Cache Manager allows programs from its home cell to run with setuid permission, but not programs from any foreign cells. A program belongs to the same cell as the file server machine that houses the volume in which the program's binary file resides, as specified in the file server machine's /etc/openafs/server/ThisCell file. The Cache Manager determines its own home cell by reading the /etc/openafs/ThisCell file at initialization. To enable programs from each specified cell to run with setuid permission, include the -suid flag. To prohibit programs from running with setuid permission, include the -nosuid flag, or omit both flags. The fs setcell command directly alters a cell's setuid status as recorded in kernel memory, so rebooting the machine is unnecessary. However, non-default settings do not persist across reboots of the machine unless the appropriate fs setcell command appears in the machine's AFS initialization file. To display a cell's setuid status, issue the fs getcellstatus command. CAUTIONS
AFS does not recognize effective UID: if a setuid program accesses AFS files and directories, it does so using the current AFS identity of the AFS user who initialized the program, not of the program's owner. Only the local file system recognizes effective UID. Only members of the system:administrators group can turn on the setuid mode bit on an AFS file or directory. When the setuid mode bit is turned on, the UNIX "ls -l" command displays the third user mode bit as an "s" instead of an "x". However, the "s" does not appear on an AFS file or directory unless setuid permission is enabled for the cell in which the file resides. OPTIONS
-cell <cell name>+ Names each cell for which to set setuid status. Provide the fully qualified domain name, or a shortened form that disambiguates it from the other cells listed in the local /etc/openafs/CellServDB file. -suid Allows programs from each specified cell to run with setuid privilege. Provide it or the -nosuid flag, or omit both flags to disallow programs from running with setuid privilege. -nosuid Prevents programs from each specified cell from running with setuid privilege. Provide it or the -suid flag, or omit both flags to disallow programs form running with setuid privilege. -help Prints the online help for this command. All other valid options are ignored. EXAMPLES
The following command enables executable files from the State University cell to run with setuid privilege on the local machine: % fs setcell -cell stateu.edu -suid PRIVILEGE REQUIRED
The issuer must be logged in as the local superuser root. SEE ALSO
fs_getcellstatus(1) COPYRIGHT
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved. This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell. OpenAFS 2012-03-26 FS_SETCELL(1)
Check Out this Related Man Page
THISCELL(5) AFS File Reference THISCELL(5) NAME
ThisCell - Defines the local cell name DESCRIPTION
The ThisCell file defines the local cell name. There are two versions of this file, one for a AFS client and one for an AFS server. Client ThisCell The client version of the ThisCell file defines the complete Internet domain-style name (for example, "abc.com") of the cell to which the local client machine belongs. It must reside in the /etc/openafs directory on every AFS client machine. To change a client machine's cell membership, edit the file and reboot the machine. The file is in ASCII format and contains a character string on a single line. The OpenAFS Quick Start Guide instructs the administrator to create it during the installation of each client machine. The client machine's cell membership determines three defaults important to its functioning: o The cell in which the machine's users authenticate by default. The effect is two-fold: o The AFS-modified login utilities and the klog command interpreter contact an Authentication Server in the cell named in the ThisCell file (unless -cell argument to the klog command specifies an alternate cell). o The command interpreters combine the cell name with the password that the user provides, generating an encryption key from the combination. For authentication to succeed, both the cell name and password must match the ones used to generate the user's encryption key stored in the Authentication Database. o The cell the Cache Manager considers its local, or home, cell. By default, the Cache Manager allows programs that reside in its home cell to run with setuid permission, but not programs from foreign cells. For more details, see the fs getcellstatus and fs setcell reference pages. o Which AFS server processes the local AFS command interpreters contact by default as they execute commands issued on the machine. The client version of the ThisCell file is distinct from the server version, which resides in the /etc/openafs/server directory on each AFS server machine. If a server machine also runs as a client, it is acceptable for the server and client versions of the file on the same machine to name different cells. However, the behavior that results from this configuration can be more confusing than useful. Server ThisCell The server version of the ThisCell file defines the complete Internet domain-style name (for example, "abc.com") of the cell to which the server machine belongs. It must reside in the /etc/openafs/server directory on every AFS server machine. The file is in ASCII format and contains a character string on a single line. The initial version of the file is created with the bos setcellname command during the installation of the cell's first file server machine, and the OpenAFS Quick Start Guide includes instructions for copying it over to additional server machine during their installation. The only reason to edit the file is as part of changing the cell's name, which is strongly discouraged because of the large number of configuration changes involved. In particular, changing the cell name requires rebuilding the entire Authentication Database, because the Authentication Server combines the cell name it finds in this file with each user and server password and converts the combination into an encryption key before recording it in the Database. SEE ALSO
bos_setcellname(8), fs_getcellstatus(1), fs_setcell(1) COPYRIGHT
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved. This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell. OpenAFS 2012-03-26 THISCELL(5)