fs_setcell - Configures permissions for setuid programs from specified cells
fs setcell -cell
] [ -nosuid
fs setce -c
The fs setcell
command sets whether the Cache Manager allows programs
(and other executable files) from each cell named by the -cell
to run with setuid permission. By default, the Cache Manager allows programs
from its home cell to run with setuid permission, but not programs from any
foreign cells. A program belongs to the same cell as the file server machine
that houses the volume in which the program's binary file resides, as
specified in the file server machine's /etc/openafs/server/ThisCell
file. The Cache Manager determines its own home cell by reading the
file at initialization.
To enable programs from each specified cell to run with setuid permission,
include the -suid
flag. To prohibit programs from running with setuid
permission, include the -nosuid
flag, or omit both flags.
The fs setcell
command directly alters a cell's setuid status as recorded
in kernel memory, so rebooting the machine is unnecessary. However,
non-default settings do not persist across reboots of the machine unless the
appropriate fs setcell
command appears in the machine's AFS
To display a cell's setuid status, issue the fs getcellstatus
AFS does not recognize effective UID: if a setuid program accesses AFS files and
directories, it does so using the current AFS identity of the AFS user who
initialized the program, not of the program's owner. Only the local file
system recognizes effective UID.
Only members of the system:administrators group can turn on the setuid mode bit
on an AFS file or directory.
When the setuid mode bit is turned on, the UNIX "ls -l" command
displays the third user mode bit as an "s" instead of an
"x". However, the "s" does not appear on an AFS file or
directory unless setuid permission is enabled for the cell in which the file
- -cell <cell name>+
- Names each cell for which to set setuid status. Provide the
fully qualified domain name, or a shortened form that disambiguates it
from the other cells listed in the local /etc/openafs/CellServDB
- Allows programs from each specified cell to run with setuid
privilege. Provide it or the -nosuid flag, or omit both flags to
disallow programs from running with setuid privilege.
- Prevents programs from each specified cell from running
with setuid privilege. Provide it or the -suid flag, or omit both
flags to disallow programs form running with setuid privilege.
- Prints the online help for this command. All other valid
options are ignored.
The following command enables executable files from the State University cell to
run with setuid privilege on the local machine:
% fs setcell -cell stateu.edu -suid
The issuer must be logged in as the local superuser root.
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
This documentation is covered by the IBM Public License Version 1.0. It was
converted from HTML to POD by software written by Chas Williams and Russ
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.