Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
SUSER(9)		 BSD Kernel Developer's	Manual		      SUSER(9)

NAME
     suser, suser_cred -- check	if credentials have superuser privilege

SYNOPSIS
     #include <sys/param.h>
     #include <sys/systm.h>

     int
     suser(struct thread *td);

     int
     suser_cred(struct ucred *cred, int	flag);

DESCRIPTION
     The suser() and suser_cred() functions check if the credentials given in-
     clude superuser powers.

     The suser() function is the most common, and should be used unless	spe-
     cial circumstances	dictate	otherwise.

     The suser_cred() function should be used when the credentials to be
     checked are not the thread's own, when there is no	thread,	when superuser
     powers should be extended to imprisoned roots, or when the	credential to
     be	checked	is the real user rather	than the effective user.

     By	default, a process does	not command superuser powers if	it has been
     imprisoned	by the jail(2) system call.  There are cases however where
     this is appropriate, and this can be done by passing SUSER_ALLOWJAIL in
     the flag argument to the suser_cred() function.  It is important to re-
     view carefully in each case that this does	not weaken the prison.	Gener-
     ally, only	where the action is protected by chroot(2) implicit in the
     jail(2) call should such powers be	granted.

     By	default, the credential	checked	is the effective user.	There are
     cases where it is instead necessary to check the real user	(for example,
     when determining if resource limits should	be applied), and this can be
     done by passing the SUSER_RUID flag in the	flag argument to the
     suser_cred() function.

     The suser() and suser_cred() functions note the fact that superuser pow-
     ers have been used	in the process structure of the	process	specified.
     Because part of their function is to notice whether superuser powers have
     been used,	the functions should only be called after other	permission
     possibilities have	been exhausted.

RETURN VALUES
     The suser() and suser_cred() functions return 0 if	the user has superuser
     powers and	EPERM otherwise.  This is the reverse logic of some other im-
     plementations of suser() in which a TRUE response indicates superuser
     powers.

SEE ALSO
     chroot(2),	jail(2)

BUGS
     The suser() and suser_cred() functions don't, in fact, record that	supe-
     ruser privileges have been	used, and haven't done so since	August 2000.

BSD				 April 2, 2002				   BSD

NAME | SYNOPSIS | DESCRIPTION | RETURN VALUES | SEE ALSO | BUGS

Want to link to this manual page? Use this URL:
<https://www.freebsd.org/cgi/man.cgi?query=suser&sektion=9&manpath=FreeBSD+5.3-RELEASE+and+Ports>

home | help