freebsd-src/lib/libsys/revoke.2

.\" Copyright (c) 1993
.\"	The Regents of the University of California.  All rights reserved.
.\"
.\" This code is derived from software contributed to Berkeley by
.\" Berkeley Software Design, Inc.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. Neither the name of the University nor the names of its contributors
.\"    may be used to endorse or promote products derived from this software
.\"    without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd January 25, 2016
.Dt REVOKE 2
.Os
.Sh NAME
.Nm revoke
.Nd revoke file access
.Sh LIBRARY
.Lb libc
.Sh SYNOPSIS
.In unistd.h
.Ft int
.Fn revoke "const char *path"
.Sh DESCRIPTION
The
.Fn revoke
system call invalidates all current open file descriptors in the system
for the file named by
.Fa path .
Subsequent operations on any such descriptors
fail, with the exceptions that a
.Fn read
from a character device file which has been revoked
returns a count of zero (end of file),
and a
.Fn close
system call will succeed.
If the file is a special file for a device which is open,
the device close function
is called as if all open references to the file had been closed
using a special close method which does not block.
.Pp
Access to a file may be revoked only by its owner or the super user.
The
.Fn revoke
system call is currently supported only for block and character special
device files.
It is normally used to prepare a terminal device for a new login session,
preventing any access by a previous user of the terminal.
.Sh RETURN VALUES
.Rv -std revoke
.Sh ERRORS
Access to the named file is revoked unless one of the following:
.Bl -tag -width Er
.It Bq Er ENOTDIR
A component of the path prefix is not a directory.
.It Bq Er ENAMETOOLONG
A component of a pathname exceeded 255 characters,
or an entire path name exceeded 1024 characters.
.It Bq Er ENOENT
The named file or a component of the path name does not exist.
.It Bq Er EACCES
Search permission is denied for a component of the path prefix.
.It Bq Er ELOOP
Too many symbolic links were encountered in translating the pathname.
.It Bq Er EFAULT
The
.Fa path
argument
points outside the process's allocated address space.
.It Bq Er EINVAL
The implementation does not support the
.Fn revoke
operation on the named file.
.It Bq Er EPERM
The caller is neither the owner of the file nor the super user.
.El
.Sh SEE ALSO
.Xr revoke 1 ,
.Xr close 2
.Sh HISTORY
The
.Fn revoke
system call first appeared in
.Bx 4.3 Reno .
.Sh BUGS
The non-blocking close method is only correctly implemented for
terminal devices.
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.\" Copyright (c) 1993`
			`.\" The Regents of the University of California. All rights reserved.`
			`.\"`
			`.\" This code is derived from software contributed to Berkeley by`
			`.\" Berkeley Software Design, Inc.`
			`.\"`
			`.\" Redistribution and use in source and binary forms, with or without`
			`.\" modification, are permitted provided that the following conditions`
			`.\" are met:`
			`.\" 1. Redistributions of source code must retain the above copyright`
			`.\" notice, this list of conditions and the following disclaimer.`
			`.\" 2. Redistributions in binary form must reproduce the above copyright`
			`.\" notice, this list of conditions and the following disclaimer in the`
			`.\" documentation and/or other materials provided with the distribution.`
Renumber copyright clause 4 Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 2017-02-28 23:42:47 +00:00			`.\" 3. Neither the name of the University nor the names of its contributors`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.\" may be used to endorse or promote products derived from this software`
			`.\" without specific prior written permission.`
			`.\"`
			.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
			`.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE`
			`.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE`
			`.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE`
			`.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL`
			`.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS`
			`.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)`
			`.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT`
			`.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY`
			`.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF`
			`.\" SUCH DAMAGE.`
			`.\"`
libc: Fix most issues reported by mandoc - varios "new sentence, new line" warnings - varios "sections out of conventional order" warnings - varios "unusual Xr order" warnings - varios "missing section argument" warnings - varios "no blank before trailing delimiter" warnings - varios "normalizing date format" warnings MFC after: 1 month 2020-12-19 14:54:28 +00:00			`.Dd January 25, 2016`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Dt REVOKE 2`
			`.Os`
			`.Sh NAME`
			`.Nm revoke`
			`.Nd revoke file access`
Introduce ".Lb" macro to libc manpages. More libraries manpages updates following. 2000-04-21 09:42:15 +00:00			`.Sh LIBRARY`
			`.Lb libc`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Sh SYNOPSIS`
mdoc(7) police: Use the new .In macro for #include statements. 2001-10-01 16:09:29 +00:00			`.In unistd.h`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Ft int`
Fixed missing const(s) or #include(s) in synopsis. 1997-04-11 18:47:10 +00:00			`.Fn revoke "const char *path"`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Sh DESCRIPTION`
			`The`
Correctly use .Fn instead of .Nm to reference function names in a bunch of man pages. Use the correct .Bx (BSD UNIX) or .At (AT&T UNIX) macros instead of explicitly specifying the version in the text in a bunch of man pages. 1996-08-22 23:31:07 +00:00			`.Fn revoke`
mdoc(7) police: Tidy up the syscall language. Stop calling system calls "function calls". Use "The .Fn system call" a-la "The .Nm utility". When referring to a non-BSD implementation in the HISTORY section, call syscall a function, to be safe. 2002-12-18 09:22:32 +00:00			`system call invalidates all current open file descriptors in the system`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`for the file named by`
			`.Fa path .`
			`Subsequent operations on any such descriptors`
			`fail, with the exceptions that a`
			`.Fn read`
			`from a character device file which has been revoked`
			`returns a count of zero (end of file),`
			`and a`
			`.Fn close`
mdoc(7) police: Tidy up the syscall language. Stop calling system calls "function calls". Use "The .Fn system call" a-la "The .Nm utility". When referring to a non-BSD implementation in the HISTORY section, call syscall a function, to be safe. 2002-12-18 09:22:32 +00:00			`system call will succeed.`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`If the file is a special file for a device which is open,`
			`the device close function`
Restore flushing of output for revoke(2) again. Document revoke()'s intended behaviour in its man page. Simplify tty_drain() to match. Don't call ttydevsw methods in tty_flush() if the device is gone since we now sometimes call it then. The flushing was supposed to be implemented by passing the FNONBLOCK flag to VOP_CLOSE() for revoke(). The tty driver is one of the few that can block in close and was one of the fewer that knew about this. This almost worked in FreeBSD-1 and similarly in Net/2. These versions only almost worked because there was and is considerable confusion between IO_NDELAY and FNONBLOCK (aka O_NONBLOCK). IO_NDELAY is only valid for VOP_READ() and VOP_WRITE(). For other VOPs it has the same value as O_SHLOCK. But since vfs_subr.c and tty.c consistently used the wrong flag and the O_SHLOCK flag is rarely set, this mostly worked. It also gave the feature than applications could get the non-blocking close by abusing O_SHLOCK. This was first broken then fixed in 1995. I changed only the tty driver to use FNONBLOCK, as a hack to get non-blocking via the normal flag FNONBLOCK for last closes. I didn't know about revoke()'s use of IO_NDELAY or change it to be consistent, so revoke() was broken. Then I changed revoke() to match. This was next broken in 1997 then fixed in 1998. Importing Lite2 made the flags inconsistent again by undoing the fix only in vfs_subr.c. This was next broken in 2008 by replacing everything in tty.c and not checking any flags in last close. Other bugs in draining limited the resulting unbounded waits to drain in some cases. It is now possible to fix this better using the new FREVOKE flag. Just restore flushing for revoke() for now. Don't restore or undo any hacks for ordinary last closes yet. But remove dead code in the 1-second relative timeout (r272789). This did extra work to extend the buggy draining for revoke() for as long as possible. The 1-second timeout made this not very long by usually flushing after 1 second. Submitted by: bde MFC after: 2 weeks 2016-01-26 07:57:44 +00:00			`is called as if all open references to the file had been closed`
			`using a special close method which does not block.`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Pp`
			`Access to a file may be revoked only by its owner or the super user.`
			`The`
Correctly use .Fn instead of .Nm to reference function names in a bunch of man pages. Use the correct .Bx (BSD UNIX) or .At (AT&T UNIX) macros instead of explicitly specifying the version in the text in a bunch of man pages. 1996-08-22 23:31:07 +00:00			`.Fn revoke`
mdoc(7) police: Tidy up the syscall language. Stop calling system calls "function calls". Use "The .Fn system call" a-la "The .Nm utility". When referring to a non-BSD implementation in the HISTORY section, call syscall a function, to be safe. 2002-12-18 09:22:32 +00:00			`system call is currently supported only for block and character special`
Backed out most of previous commit to go with backing out support for revoke() on non-device files. 1999-01-24 06:43:30 +00:00			`device files.`
			`It is normally used to prepare a terminal device for a new login session,`
			`preventing any access by a previous user of the terminal.`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Sh RETURN VALUES`
Use the ``.Rv -std'' mdoc(7) macro in appropriate cases. Reviewed by: ru 2001-08-09 13:32:13 +00:00			`.Rv -std revoke`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Sh ERRORS`
			`Access to the named file is revoked unless one of the following:`
			`.Bl -tag -width Er`
			`.It Bq Er ENOTDIR`
			`A component of the path prefix is not a directory.`
			`.It Bq Er ENAMETOOLONG`
			`A component of a pathname exceeded 255 characters,`
			`or an entire path name exceeded 1024 characters.`
			`.It Bq Er ENOENT`
			`The named file or a component of the path name does not exist.`
			`.It Bq Er EACCES`
			`Search permission is denied for a component of the path prefix.`
			`.It Bq Er ELOOP`
			`Too many symbolic links were encountered in translating the pathname.`
			`.It Bq Er EFAULT`
mdoc(7) police: "The .Fa argument.". 2002-12-19 09:40:28 +00:00			`The`
			`.Fa path`
			`argument`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`points outside the process's allocated address space.`
			`.It Bq Er EINVAL`
Backed out most of previous commit to go with backing out support for revoke() on non-device files. 1999-01-24 06:43:30 +00:00			`The implementation does not support the`
revoke(2) is supported on regular files under current. Change wording in manual page that indicated otherwise. PR: docs/9517 Submitted by: David Malone <dwmalone@maths.tcd.ie> 1999-01-18 02:37:03 +00:00			`.Fn revoke`
Backed out most of previous commit to go with backing out support for revoke() on non-device files. 1999-01-24 06:43:30 +00:00			`operation on the named file.`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.It Bq Er EPERM`
			`The caller is neither the owner of the file nor the super user.`
			`.El`
			`.Sh SEE ALSO`
Various mdoc fixes and a few EOL whitespace removals. Found with: mandoc -Tlint 2014-12-21 12:36:36 +00:00			`.Xr revoke 1 ,`
			`.Xr close 2`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Sh HISTORY`
			`The`
Correctly use .Fn instead of .Nm to reference function names in a bunch of man pages. Use the correct .Bx (BSD UNIX) or .At (AT&T UNIX) macros instead of explicitly specifying the version in the text in a bunch of man pages. 1996-08-22 23:31:07 +00:00			`.Fn revoke`
mdoc(7) police: Tidy up the syscall language. Stop calling system calls "function calls". Use "The .Fn system call" a-la "The .Nm utility". When referring to a non-BSD implementation in the HISTORY section, call syscall a function, to be safe. 2002-12-18 09:22:32 +00:00			`system call first appeared in`
BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00			`.Bx 4.3 Reno .`
Restore flushing of output for revoke(2) again. Document revoke()'s intended behaviour in its man page. Simplify tty_drain() to match. Don't call ttydevsw methods in tty_flush() if the device is gone since we now sometimes call it then. The flushing was supposed to be implemented by passing the FNONBLOCK flag to VOP_CLOSE() for revoke(). The tty driver is one of the few that can block in close and was one of the fewer that knew about this. This almost worked in FreeBSD-1 and similarly in Net/2. These versions only almost worked because there was and is considerable confusion between IO_NDELAY and FNONBLOCK (aka O_NONBLOCK). IO_NDELAY is only valid for VOP_READ() and VOP_WRITE(). For other VOPs it has the same value as O_SHLOCK. But since vfs_subr.c and tty.c consistently used the wrong flag and the O_SHLOCK flag is rarely set, this mostly worked. It also gave the feature than applications could get the non-blocking close by abusing O_SHLOCK. This was first broken then fixed in 1995. I changed only the tty driver to use FNONBLOCK, as a hack to get non-blocking via the normal flag FNONBLOCK for last closes. I didn't know about revoke()'s use of IO_NDELAY or change it to be consistent, so revoke() was broken. Then I changed revoke() to match. This was next broken in 1997 then fixed in 1998. Importing Lite2 made the flags inconsistent again by undoing the fix only in vfs_subr.c. This was next broken in 2008 by replacing everything in tty.c and not checking any flags in last close. Other bugs in draining limited the resulting unbounded waits to drain in some cases. It is now possible to fix this better using the new FREVOKE flag. Just restore flushing for revoke() for now. Don't restore or undo any hacks for ordinary last closes yet. But remove dead code in the 1-second relative timeout (r272789). This did extra work to extend the buggy draining for revoke() for as long as possible. The 1-second timeout made this not very long by usually flushing after 1 second. Submitted by: bde MFC after: 2 weeks 2016-01-26 07:57:44 +00:00			`.Sh BUGS`
			`The non-blocking close method is only correctly implemented for`
			`terminal devices.`