.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.20)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.ie \nF \{\
.    de IX
.    tm Index:\\$1\t\\n%\t"\\$2"
..
.    nr % 0
.    rr F
.\}
.el \{\
.    de IX
..
.\}
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "FS_SETCELL 1"
.TH FS_SETCELL 1 "2021-12-09" "OpenAFS" "AFS Command Reference"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
fs_setcell \- Configures permissions for setuid programs from specified cells
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
\&\fBfs setcell\fR \fB\-cell\fR\ <\fIcell\ name\fR>+ [\fB\-suid\fR] [\fB\-nosuid\fR] [\fB\-help\fR]
.PP
\&\fBfs setce\fR \fB\-c\fR\ <\fIcell\ name\fR>+ [\fB\-s\fR] [\fB\-n\fR] [\fB\-h\fR]
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
The \fBfs setcell\fR command sets whether the Cache Manager allows programs
(and other executable files) from each cell named by the \fB\-cell\fR argument
to run with setuid permission. By default, the Cache Manager allows
programs from its home cell to run with setuid permission, but not
programs from any foreign cells. A program belongs to the same cell as the
file server machine that houses the volume in which the program's binary
file resides, as specified in the file server machine's
\&\fI/usr/afs/etc/ThisCell\fR file. The Cache Manager determines its own home
cell by reading the \fI/usr/vice/etc/ThisCell\fR file at initialization.
.PP
To enable programs from each specified cell to run with setuid permission,
include the \fB\-suid\fR flag. To prohibit programs from running with setuid
permission, include the \fB\-nosuid\fR flag, or omit both flags.
.PP
The \fBfs setcell\fR command directly alters a cell's setuid status as
recorded in kernel memory, so rebooting the machine is unnecessary.
However, non-default settings do not persist across reboots of the machine
unless the appropriate \fBfs setcell\fR command appears in the machine's \s-1AFS\s0
initialization file.
.PP
To display a cell's setuid status, issue the \fBfs getcellstatus\fR command.
.SH "CAUTIONS"
.IX Header "CAUTIONS"
\&\s-1AFS\s0 does not recognize effective \s-1UID:\s0 if a setuid program accesses \s-1AFS\s0
files and directories, it does so using the current \s-1AFS\s0 identity of the
\&\s-1AFS\s0 user who initialized the program, not of the program's owner.  Only
the local file system recognizes effective \s-1UID\s0.
.PP
Only members of the system:administrators group can turn on the setuid
mode bit on an \s-1AFS\s0 file or directory.
.PP
When the setuid mode bit is turned on, the \s-1UNIX\s0 \f(CW\*(C`ls \-l\*(C'\fR command displays
the third user mode bit as an \f(CW\*(C`s\*(C'\fR instead of an \f(CW\*(C`x\*(C'\fR. However, the \f(CW\*(C`s\*(C'\fR
does not appear on an \s-1AFS\s0 file or directory unless setuid permission is
enabled for the cell in which the file resides.
.SH "OPTIONS"
.IX Header "OPTIONS"
.IP "\fB\-cell\fR <\fIcell name\fR>+" 4
.IX Item "-cell <cell name>+"
Names each cell for which to set setuid status. Provide the fully
qualified domain name, or a shortened form that disambiguates it from the
other cells listed in the local \fI/usr/vice/etc/CellServDB\fR file.
.IP "\fB\-suid\fR" 4
.IX Item "-suid"
Allows programs from each specified cell to run with setuid
privilege. Provide it or the \fB\-nosuid\fR flag, or omit both flags to
disallow programs from running with setuid privilege.
.IP "\fB\-nosuid\fR" 4
.IX Item "-nosuid"
Prevents programs from each specified cell from running with setuid
privilege. Provide it or the \fB\-suid\fR flag, or omit both flags to disallow
programs form running with setuid privilege.
.IP "\fB\-help\fR" 4
.IX Item "-help"
Prints the online help for this command. All other valid options are
ignored.
.SH "EXAMPLES"
.IX Header "EXAMPLES"
The following command enables executable files from the Example Organization
cell to run with setuid privilege on the local machine:
.PP
.Vb 1
\&   % fs setcell \-cell example.org \-suid
.Ve
.SH "PRIVILEGE REQUIRED"
.IX Header "PRIVILEGE REQUIRED"
The issuer must be logged in as the local superuser root.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fIfs_getcellstatus\fR\|(1)
.SH "COPYRIGHT"
.IX Header "COPYRIGHT"
\&\s-1IBM\s0 Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
.PP
This documentation is covered by the \s-1IBM\s0 Public License Version 1.0.  It was
converted from \s-1HTML\s0 to \s-1POD\s0 by software written by Chas Williams and Russ
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.