# SOME DESCRIPTIVE TITLE # Copyright (C) YEAR Free Software Foundation, Inc. # This file is distributed under the same license as the PACKAGE package. # FIRST AUTHOR , YEAR. # msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "POT-Creation-Date: 2014-04-17 13:14+0900\n" "PO-Revision-Date: 2014-04-14 08:53+0900\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. type: TH #: build/C/man2/acct.2:31 build/C/man5/acct.5:25 #, no-wrap msgid "ACCT" msgstr "ACCT" #. type: TH #: build/C/man2/acct.2:31 #, no-wrap msgid "2008-06-16" msgstr "2008-06-16" #. type: TH #: build/C/man2/acct.2:31 build/C/man5/acct.5:25 #: build/C/man7/capabilities.7:48 build/C/man2/capget.2:15 #: build/C/man7/cpuset.7:25 build/C/man7/credentials.7:27 #: build/C/man2/getgid.2:25 build/C/man2/getgroups.2:31 #: build/C/man2/getpid.2:25 build/C/man2/getpriority.2:48 #: build/C/man2/getresuid.2:28 build/C/man2/getrlimit.2:64 #: build/C/man2/getrusage.2:39 build/C/man2/getsid.2:26 #: build/C/man2/getuid.2:26 build/C/man2/iopl.2:33 #: build/C/man2/ioprio_set.2:24 build/C/man2/ipc.2:25 #: build/C/man2/seteuid.2:29 build/C/man2/setfsgid.2:31 #: build/C/man2/setfsuid.2:31 build/C/man2/setgid.2:29 #: build/C/man2/setpgid.2:48 build/C/man2/setresuid.2:26 #: build/C/man2/setreuid.2:45 build/C/man2/setsid.2:30 #: build/C/man2/setuid.2:30 build/C/man7/svipc.7:40 build/C/man3/ulimit.3:27 #, no-wrap msgid "Linux" msgstr "Linux" #. type: TH #: build/C/man2/acct.2:31 build/C/man5/acct.5:25 #: build/C/man7/capabilities.7:48 build/C/man2/capget.2:15 #: build/C/man7/cpuset.7:25 build/C/man7/credentials.7:27 #: build/C/man2/getgid.2:25 build/C/man2/getgroups.2:31 #: build/C/man2/getpid.2:25 build/C/man2/getpriority.2:48 #: build/C/man2/getresuid.2:28 build/C/man2/getrlimit.2:64 #: build/C/man2/getrusage.2:39 build/C/man2/getsid.2:26 #: build/C/man2/getuid.2:26 build/C/man2/iopl.2:33 #: build/C/man2/ioprio_set.2:24 build/C/man2/ipc.2:25 #: build/C/man2/seteuid.2:29 build/C/man2/setfsgid.2:31 #: build/C/man2/setfsuid.2:31 build/C/man2/setgid.2:29 #: build/C/man2/setpgid.2:48 build/C/man2/setresuid.2:26 #: build/C/man2/setreuid.2:45 build/C/man2/setsid.2:30 #: build/C/man2/setuid.2:30 build/C/man7/svipc.7:40 build/C/man3/ulimit.3:27 #, no-wrap msgid "Linux Programmer's Manual" msgstr "Linux Programmer's Manual" #. type: SH #: build/C/man2/acct.2:32 build/C/man5/acct.5:26 #: build/C/man7/capabilities.7:49 build/C/man2/capget.2:16 #: build/C/man7/cpuset.7:26 build/C/man7/credentials.7:28 #: build/C/man2/getgid.2:26 build/C/man2/getgroups.2:32 #: build/C/man2/getpid.2:26 build/C/man2/getpriority.2:49 #: build/C/man2/getresuid.2:29 build/C/man2/getrlimit.2:65 #: build/C/man2/getrusage.2:40 build/C/man2/getsid.2:27 #: build/C/man2/getuid.2:27 build/C/man2/iopl.2:34 #: build/C/man2/ioprio_set.2:25 build/C/man2/ipc.2:26 #: build/C/man2/seteuid.2:30 build/C/man2/setfsgid.2:32 #: build/C/man2/setfsuid.2:32 build/C/man2/setgid.2:30 #: build/C/man2/setpgid.2:49 build/C/man2/setresuid.2:27 #: build/C/man2/setreuid.2:46 build/C/man2/setsid.2:31 #: build/C/man2/setuid.2:31 build/C/man7/svipc.7:41 build/C/man3/ulimit.3:28 #, no-wrap msgid "NAME" msgstr "名前" #. type: Plain text #: build/C/man2/acct.2:34 msgid "acct - switch process accounting on or off" msgstr "acct - プロセス・アカウントのオンとオフを切り換える" #. type: SH #: build/C/man2/acct.2:34 build/C/man5/acct.5:28 build/C/man2/capget.2:18 #: build/C/man2/getgid.2:28 build/C/man2/getgroups.2:34 #: build/C/man2/getpid.2:28 build/C/man2/getpriority.2:51 #: build/C/man2/getresuid.2:31 build/C/man2/getrlimit.2:67 #: build/C/man2/getrusage.2:42 build/C/man2/getsid.2:29 #: build/C/man2/getuid.2:29 build/C/man2/iopl.2:36 #: build/C/man2/ioprio_set.2:27 build/C/man2/ipc.2:28 #: build/C/man2/seteuid.2:32 build/C/man2/setfsgid.2:34 #: build/C/man2/setfsuid.2:34 build/C/man2/setgid.2:32 #: build/C/man2/setpgid.2:51 build/C/man2/setresuid.2:29 #: build/C/man2/setreuid.2:48 build/C/man2/setsid.2:33 #: build/C/man2/setuid.2:33 build/C/man7/svipc.7:43 build/C/man3/ulimit.3:30 #, no-wrap msgid "SYNOPSIS" msgstr "書式" #. type: Plain text #: build/C/man2/acct.2:38 #, no-wrap msgid "B<#include Eunistd.hE>\n" msgstr "B<#include Eunistd.hE>\n" #. type: Plain text #: build/C/man2/acct.2:40 #, no-wrap msgid "BIB<);>\n" msgstr "BIB<);>\n" #. type: Plain text #: build/C/man2/acct.2:46 build/C/man2/getgroups.2:48 #: build/C/man2/getrlimit.2:84 build/C/man2/getsid.2:37 #: build/C/man2/seteuid.2:44 build/C/man2/setpgid.2:71 #: build/C/man2/setreuid.2:60 msgid "" "Feature Test Macro Requirements for glibc (see B(7)):" msgstr "glibc 向けの機能検査マクロの要件 (B(7) 参照):" #. type: Plain text #: build/C/man2/acct.2:50 msgid "" "B(): _BSD_SOURCE || (_XOPEN_SOURCE && _XOPEN_SOURCE\\ E\\ 500)" msgstr "" "B(): _BSD_SOURCE || (_XOPEN_SOURCE && _XOPEN_SOURCE\\ E\\ 500)" #. type: SH #: build/C/man2/acct.2:50 build/C/man5/acct.5:30 #: build/C/man7/capabilities.7:51 build/C/man2/capget.2:24 #: build/C/man7/cpuset.7:28 build/C/man7/credentials.7:30 #: build/C/man2/getgid.2:36 build/C/man2/getgroups.2:52 #: build/C/man2/getpid.2:36 build/C/man2/getpriority.2:59 #: build/C/man2/getresuid.2:39 build/C/man2/getrlimit.2:88 #: build/C/man2/getrusage.2:48 build/C/man2/getsid.2:50 #: build/C/man2/getuid.2:37 build/C/man2/iopl.2:40 #: build/C/man2/ioprio_set.2:35 build/C/man2/ipc.2:34 #: build/C/man2/seteuid.2:53 build/C/man2/setfsgid.2:38 #: build/C/man2/setfsuid.2:38 build/C/man2/setgid.2:38 #: build/C/man2/setpgid.2:100 build/C/man2/setresuid.2:37 #: build/C/man2/setreuid.2:70 build/C/man2/setsid.2:40 #: build/C/man2/setuid.2:39 build/C/man7/svipc.7:49 build/C/man3/ulimit.3:34 #, no-wrap msgid "DESCRIPTION" msgstr "説明" #. type: Plain text #: build/C/man2/acct.2:60 msgid "" "The B() system call enables or disables process accounting. If " "called with the name of an existing file as its argument, accounting is " "turned on, and records for each terminating process are appended to " "I as it terminates. An argument of NULL causes accounting to be " "turned off." msgstr "" "B() システムコールは、プロセス・アカウントの有効・無効を切り替える。 " "既存のファイルの名前を引き数に指定して呼び出されたら、 アカウント (account) " "が有効になり、 終了したプロセスの記録が I に追記される。 NULL を引" "き数として呼び出されたらアカウントをオフにする。" #. type: SH #: build/C/man2/acct.2:60 build/C/man2/capget.2:160 #: build/C/man2/getgroups.2:92 build/C/man2/getpriority.2:107 #: build/C/man2/getresuid.2:50 build/C/man2/getrlimit.2:430 #: build/C/man2/getrusage.2:181 build/C/man2/getsid.2:58 #: build/C/man2/iopl.2:66 build/C/man2/ioprio_set.2:149 #: build/C/man2/seteuid.2:67 build/C/man2/setfsgid.2:68 #: build/C/man2/setfsuid.2:68 build/C/man2/setgid.2:53 #: build/C/man2/setpgid.2:195 build/C/man2/setresuid.2:64 #: build/C/man2/setreuid.2:93 build/C/man2/setsid.2:51 #: build/C/man2/setuid.2:70 build/C/man3/ulimit.3:67 #, no-wrap msgid "RETURN VALUE" msgstr "返り値" #. type: Plain text #: build/C/man2/acct.2:65 build/C/man2/capget.2:165 #: build/C/man2/getresuid.2:55 build/C/man2/getrusage.2:186 #: build/C/man2/iopl.2:71 build/C/man2/seteuid.2:72 build/C/man2/setgid.2:58 #: build/C/man2/setresuid.2:69 build/C/man2/setreuid.2:98 #: build/C/man2/setuid.2:75 msgid "" "On success, zero is returned. On error, -1 is returned, and I is set " "appropriately." msgstr "" "成功した場合は 0 が返される。エラーの場合は -1 が返され、 I が適切に設" "定される。" #. type: SH #: build/C/man2/acct.2:65 build/C/man2/capget.2:179 build/C/man7/cpuset.7:1100 #: build/C/man2/getgid.2:42 build/C/man2/getgroups.2:106 #: build/C/man2/getpid.2:44 build/C/man2/getpriority.2:120 #: build/C/man2/getresuid.2:55 build/C/man2/getrlimit.2:435 #: build/C/man2/getrusage.2:186 build/C/man2/getsid.2:63 #: build/C/man2/getuid.2:43 build/C/man2/iopl.2:71 #: build/C/man2/ioprio_set.2:169 build/C/man2/seteuid.2:72 #: build/C/man2/setgid.2:58 build/C/man2/setpgid.2:216 #: build/C/man2/setresuid.2:69 build/C/man2/setreuid.2:98 #: build/C/man2/setsid.2:58 build/C/man2/setuid.2:75 build/C/man3/ulimit.3:74 #, no-wrap msgid "ERRORS" msgstr "エラー" #. type: TP #: build/C/man2/acct.2:66 build/C/man7/cpuset.7:1116 #: build/C/man7/cpuset.7:1123 build/C/man7/cpuset.7:1129 #: build/C/man7/cpuset.7:1137 build/C/man7/cpuset.7:1144 #: build/C/man2/getpriority.2:140 build/C/man2/setpgid.2:217 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:77 msgid "" "Write permission is denied for the specified file, or search permission is " "denied for one of the directories in the path prefix of I (see " "also B(7)), or I is not a regular file." msgstr "" "指定したファイルへの書き込み許可がなく、書き込みが拒否された。 または " "I のディレクトリ部分の何れかのディレクトリに検索許可がなく拒否され" "た (B(7) も参照すること)。 または I が通常 " "(regular) のファイルでない。" #. type: TP #: build/C/man2/acct.2:77 build/C/man2/capget.2:180 build/C/man7/cpuset.7:1172 #: build/C/man2/getgroups.2:107 build/C/man2/getresuid.2:56 #: build/C/man2/getrlimit.2:436 build/C/man2/getrusage.2:187 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:81 msgid "I points outside your accessible address space." msgstr "アクセスできるアドレス空間の外を I が指している。" #. type: TP #: build/C/man2/acct.2:81 build/C/man7/cpuset.7:1238 #: build/C/man7/cpuset.7:1246 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:85 msgid "Error writing to the file I." msgstr "I への書き込みにエラーが発生した。" #. type: TP #: build/C/man2/acct.2:85 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:89 msgid "I is a directory." msgstr "I がディレクトリである。" #. type: TP #: build/C/man2/acct.2:89 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:93 msgid "Too many symbolic links were encountered in resolving I." msgstr "I の実体にたどり着くまでのシンボリックリンクの数が多すぎる。" #. type: TP #: build/C/man2/acct.2:93 build/C/man7/cpuset.7:1251 #: build/C/man7/cpuset.7:1258 build/C/man7/cpuset.7:1263 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:97 msgid "I was too long." msgstr "I が長すぎる。" #. type: TP #: build/C/man2/acct.2:97 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:100 msgid "The system limit on the total number of open files has been reached." msgstr "オープンされたファイルの総数がシステム制限に達した。" #. type: TP #: build/C/man2/acct.2:100 build/C/man7/cpuset.7:1275 #: build/C/man7/cpuset.7:1280 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:103 msgid "The specified filename does not exist." msgstr "指定されたファイルが存在しない。" #. type: TP #: build/C/man2/acct.2:103 build/C/man7/cpuset.7:1287 #: build/C/man2/getgroups.2:127 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:106 build/C/man2/getgroups.2:130 msgid "Out of memory." msgstr "メモリ不足。" #. type: TP #: build/C/man2/acct.2:106 build/C/man2/iopl.2:76 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:112 msgid "" "BSD process accounting has not been enabled when the operating system kernel " "was compiled. The kernel configuration parameter controlling this feature " "is B." msgstr "" "カーネルをコンパイルした時に BSD プロセス・アカウントが有効になっていない。 " "この機能はカーネルのコンフィグの B パラメータによっ" "て制御される。" #. type: TP #: build/C/man2/acct.2:112 build/C/man7/cpuset.7:1314 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:117 msgid "" "A component used as a directory in I is not in fact a directory." msgstr "" "I の中でディレクトリして扱われている要素が、 実際はディレクトリでな" "い。" #. type: TP #: build/C/man2/acct.2:117 build/C/man2/capget.2:191 build/C/man2/capget.2:196 #: build/C/man7/cpuset.7:1319 build/C/man2/getgroups.2:130 #: build/C/man2/getpriority.2:152 build/C/man2/getrlimit.2:452 #: build/C/man2/getsid.2:64 build/C/man2/iopl.2:79 #: build/C/man2/ioprio_set.2:179 build/C/man2/seteuid.2:75 #: build/C/man2/setgid.2:59 build/C/man2/setpgid.2:231 #: build/C/man2/setresuid.2:77 build/C/man2/setreuid.2:99 #: build/C/man2/setsid.2:59 build/C/man2/setuid.2:85 build/C/man3/ulimit.3:75 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:123 msgid "" "The calling process has insufficient privilege to enable process " "accounting. On Linux the B capability is required." msgstr "" "呼び出したプロセスにはプロセス・アカウントを有効にするのに十分な特権がない。 " "Linux では B ケーパビリティ (capability) が必要である。" #. type: TP #: build/C/man2/acct.2:123 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:127 msgid "I refers to a file on a read-only filesystem." msgstr "" "読み込みだけのファイルシステム上のファイルを I が参照している。" #. type: TP #: build/C/man2/acct.2:127 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/acct.2:130 msgid "There are no more free file structures or we ran out of memory." msgstr "使用可能なファイル構造体がないか、メモリが足りない。" #. type: SH #: build/C/man2/acct.2:130 build/C/man5/acct.5:153 #: build/C/man7/capabilities.7:1079 build/C/man2/capget.2:218 #: build/C/man7/credentials.7:286 build/C/man2/getgid.2:44 #: build/C/man2/getgroups.2:133 build/C/man2/getpid.2:46 #: build/C/man2/getpriority.2:160 build/C/man2/getresuid.2:67 #: build/C/man2/getrlimit.2:473 build/C/man2/getrusage.2:195 #: build/C/man2/getsid.2:79 build/C/man2/getuid.2:45 build/C/man2/iopl.2:87 #: build/C/man2/ioprio_set.2:196 build/C/man2/ipc.2:45 #: build/C/man2/seteuid.2:91 build/C/man2/setfsgid.2:75 #: build/C/man2/setfsuid.2:75 build/C/man2/setgid.2:66 #: build/C/man2/setpgid.2:250 build/C/man2/setresuid.2:83 #: build/C/man2/setreuid.2:115 build/C/man2/setsid.2:65 #: build/C/man2/setuid.2:92 build/C/man3/ulimit.3:78 #, no-wrap msgid "CONFORMING TO" msgstr "準拠" #. SVr4 documents an EBUSY error condition, but no EISDIR or ENOSYS. #. Also AIX and HP-UX document EBUSY (attempt is made #. to enable accounting when it is already enabled), as does Solaris #. (attempt is made to enable accounting using the same file that is #. currently being used). #. type: Plain text #: build/C/man2/acct.2:137 msgid "SVr4, 4.3BSD (but not POSIX)." msgstr "SVr4, 4.3BSD (POSIX ではない)。" #. type: SH #: build/C/man2/acct.2:137 build/C/man5/acct.5:157 #: build/C/man7/capabilities.7:1085 build/C/man2/capget.2:220 #: build/C/man7/cpuset.7:1341 build/C/man7/credentials.7:292 #: build/C/man2/getgid.2:46 build/C/man2/getgroups.2:141 #: build/C/man2/getpid.2:48 build/C/man2/getpriority.2:163 #: build/C/man2/getresuid.2:70 build/C/man2/getrlimit.2:496 #: build/C/man2/getrusage.2:206 build/C/man2/getsid.2:81 #: build/C/man2/getuid.2:47 build/C/man2/iopl.2:91 #: build/C/man2/ioprio_set.2:198 build/C/man2/ipc.2:49 #: build/C/man2/seteuid.2:93 build/C/man2/setfsgid.2:79 #: build/C/man2/setfsuid.2:79 build/C/man2/setgid.2:68 #: build/C/man2/setpgid.2:272 build/C/man2/setresuid.2:86 #: build/C/man2/setreuid.2:121 build/C/man2/setsid.2:67 #: build/C/man2/setuid.2:97 #, no-wrap msgid "NOTES" msgstr "注意" #. type: Plain text #: build/C/man2/acct.2:140 msgid "" "No accounting is produced for programs running when a system crash occurs. " "In particular, nonterminating processes are never accounted for." msgstr "" "システムがクラッシュした時に実行中だったプログラムのアカウントは生成されな" "い。 特に、終了しないプログラムがアカウントされることはない。" #. type: Plain text #: build/C/man2/acct.2:143 msgid "" "The structure of the records written to the accounting file is described in " "B(5)." msgstr "" "アカウント用ファイルに書き込まれるレコードの構造体については B(5) に説" "明がある。" #. type: SH #: build/C/man2/acct.2:143 build/C/man5/acct.5:174 #: build/C/man7/capabilities.7:1141 build/C/man2/capget.2:228 #: build/C/man7/cpuset.7:1488 build/C/man7/credentials.7:303 #: build/C/man2/getgid.2:62 build/C/man2/getgroups.2:178 #: build/C/man2/getpid.2:100 build/C/man2/getpriority.2:232 #: build/C/man2/getresuid.2:86 build/C/man2/getrlimit.2:661 #: build/C/man2/getrusage.2:246 build/C/man2/getsid.2:84 #: build/C/man2/getuid.2:73 build/C/man2/iopl.2:100 #: build/C/man2/ioprio_set.2:346 build/C/man2/ipc.2:57 #: build/C/man2/seteuid.2:124 build/C/man2/setfsgid.2:123 #: build/C/man2/setfsuid.2:131 build/C/man2/setgid.2:78 #: build/C/man2/setpgid.2:340 build/C/man2/setresuid.2:106 #: build/C/man2/setreuid.2:161 build/C/man2/setsid.2:84 #: build/C/man2/setuid.2:120 build/C/man7/svipc.7:331 build/C/man3/ulimit.3:83 #, no-wrap msgid "SEE ALSO" msgstr "関連項目" #. type: Plain text #: build/C/man2/acct.2:145 msgid "B(5)" msgstr "B(5)" #. type: SH #: build/C/man2/acct.2:145 build/C/man5/acct.5:179 #: build/C/man7/capabilities.7:1161 build/C/man2/capget.2:232 #: build/C/man7/cpuset.7:1505 build/C/man7/credentials.7:335 #: build/C/man2/getgid.2:67 build/C/man2/getgroups.2:185 #: build/C/man2/getpid.2:110 build/C/man2/getpriority.2:240 #: build/C/man2/getresuid.2:92 build/C/man2/getrlimit.2:679 #: build/C/man2/getrusage.2:253 build/C/man2/getsid.2:88 #: build/C/man2/getuid.2:78 build/C/man2/iopl.2:104 #: build/C/man2/ioprio_set.2:354 build/C/man2/ipc.2:70 #: build/C/man2/seteuid.2:131 build/C/man2/setfsgid.2:128 #: build/C/man2/setfsuid.2:136 build/C/man2/setgid.2:84 #: build/C/man2/setpgid.2:347 build/C/man2/setresuid.2:115 #: build/C/man2/setreuid.2:169 build/C/man2/setsid.2:91 #: build/C/man2/setuid.2:127 build/C/man7/svipc.7:348 build/C/man3/ulimit.3:88 #, no-wrap msgid "COLOPHON" msgstr "この文書について" #. type: Plain text #: build/C/man2/acct.2:152 build/C/man5/acct.5:186 #: build/C/man7/capabilities.7:1168 build/C/man2/capget.2:239 #: build/C/man7/cpuset.7:1512 build/C/man7/credentials.7:342 #: build/C/man2/getgid.2:74 build/C/man2/getgroups.2:192 #: build/C/man2/getpid.2:117 build/C/man2/getpriority.2:247 #: build/C/man2/getresuid.2:99 build/C/man2/getrlimit.2:686 #: build/C/man2/getrusage.2:260 build/C/man2/getsid.2:95 #: build/C/man2/getuid.2:85 build/C/man2/iopl.2:111 #: build/C/man2/ioprio_set.2:361 build/C/man2/ipc.2:77 #: build/C/man2/seteuid.2:138 build/C/man2/setfsgid.2:135 #: build/C/man2/setfsuid.2:143 build/C/man2/setgid.2:91 #: build/C/man2/setpgid.2:354 build/C/man2/setresuid.2:122 #: build/C/man2/setreuid.2:176 build/C/man2/setsid.2:98 #: build/C/man2/setuid.2:134 build/C/man7/svipc.7:355 build/C/man3/ulimit.3:95 #, fuzzy #| msgid "" #| "This page is part of release 3.63 of the Linux I project. A " #| "description of the project, and information about reporting bugs, can be " #| "found at \\%http://www.kernel.org/doc/man-pages/." msgid "" "This page is part of release 3.64 of the Linux I project. A " "description of the project, and information about reporting bugs, can be " "found at \\%http://www.kernel.org/doc/man-pages/." msgstr "" "この man ページは Linux I プロジェクトのリリース 3.63 の一部\n" "である。プロジェクトの説明とバグ報告に関する情報は\n" "http://www.kernel.org/doc/man-pages/ に書かれている。" #. type: TH #: build/C/man5/acct.5:25 #, no-wrap msgid "2008-06-15" msgstr "2008-06-15" #. type: Plain text #: build/C/man5/acct.5:28 msgid "acct - process accounting file" msgstr "acct - プロセス・アカウンティング・ファイル" #. type: Plain text #: build/C/man5/acct.5:30 msgid "B<#include Esys/acct.hE>" msgstr "B<#include Esys/acct.hE>" #. type: Plain text #: build/C/man5/acct.5:36 msgid "" "If the kernel is built with the process accounting option enabled " "(B), then calling B(2) starts process " "accounting, for example:" msgstr "" "カーネルがプロセス・アカウンティングのオプション " "(B) を有効にして作成されていると、以下のように " "B(2) を呼び出すとプロセス・アカウンティングが開始される。" #. type: Plain text #: build/C/man5/acct.5:39 msgid "acct(\"/var/log/pacct\");" msgstr "acct(\"/var/log/pacct\");" #. type: Plain text #: build/C/man5/acct.5:47 msgid "" "When process accounting is enabled, the kernel writes a record to the " "accounting file as each process on the system terminates. This record " "contains information about the terminated process, and is defined in " "Isys/acct.hE> as follows:" msgstr "" "プロセス・アカウンティングが有効になっていると、カーネルは システム上の各プロ" "セスが終了するたびにアカウンティングファイルに レコードを書き込む。 このレ" "コードは、終了したプロセスに関する情報を保持するもので、 Isys/acct." "hE> で以下のように定義されている。" #. type: Plain text #: build/C/man5/acct.5:51 #, no-wrap msgid "#define ACCT_COMM 16\n" msgstr "#define ACCT_COMM 16\n" #. type: Plain text #: build/C/man5/acct.5:53 #, no-wrap msgid "typedef u_int16_t comp_t;\n" msgstr "typedef u_int16_t comp_t;\n" #. type: Plain text #: build/C/man5/acct.5:77 #, no-wrap msgid "" "struct acct {\n" " char ac_flag; /* Accounting flags */\n" " u_int16_t ac_uid; /* Accounting user ID */\n" " u_int16_t ac_gid; /* Accounting group ID */\n" " u_int16_t ac_tty; /* Controlling terminal */\n" " u_int32_t ac_btime; /* Process creation time\n" " (seconds since the Epoch) */\n" " comp_t ac_utime; /* User CPU time */\n" " comp_t ac_stime; /* System CPU time */\n" " comp_t ac_etime; /* Elapsed time */\n" " comp_t ac_mem; /* Average memory usage (kB) */\n" " comp_t ac_io; /* Characters transferred (unused) */\n" " comp_t ac_rw; /* Blocks read or written (unused) */\n" " comp_t ac_minflt; /* Minor page faults */\n" " comp_t ac_majflt; /* Major page faults */\n" " comp_t ac_swaps; /* Number of swaps (unused) */\n" " u_int32_t ac_exitcode; /* Process termination status\n" " (see wait(2)) */\n" " char ac_comm[ACCT_COMM+1];\n" " /* Command name (basename of last\n" " executed command; null-terminated) */\n" " char ac_pad[I]; /* padding bytes */\n" "};\n" msgstr "" "struct acct {\n" " char ac_flag; /* Accounting flags */\n" " u_int16_t ac_uid; /* Accounting user ID */\n" " u_int16_t ac_gid; /* Accounting group ID */\n" " u_int16_t ac_tty; /* Controlling terminal */\n" " u_int32_t ac_btime; /* Process creation time\n" " (seconds since the Epoch) */\n" " comp_t ac_utime; /* User CPU time */\n" " comp_t ac_stime; /* System CPU time */\n" " comp_t ac_etime; /* Elapsed time */\n" " comp_t ac_mem; /* Average memory usage (kB) */\n" " comp_t ac_io; /* Characters transferred (unused) */\n" " comp_t ac_rw; /* Blocks read or written (unused) */\n" " comp_t ac_minflt; /* Minor page faults */\n" " comp_t ac_majflt; /* Major page faults */\n" " comp_t ac_swaps; /* Number of swaps (unused) */\n" " u_int32_t ac_exitcode; /* Process termination status\n" " (see wait(2)) */\n" " char ac_comm[ACCT_COMM+1];\n" " /* Command name (basename of last\n" " executed command; null-terminated) */\n" " char ac_pad[I]; /* padding bytes */\n" "};\n" #. type: Plain text #: build/C/man5/acct.5:84 #, no-wrap msgid "" "enum { /* Bits that may be set in ac_flag field */\n" " AFORK = 0x01, /* Has executed fork, but no exec */\n" " ASU = 0x02, /* Used superuser privileges */\n" " ACORE = 0x08, /* Dumped core */\n" " AXSIG = 0x10 /* Killed by a signal */\n" "};\n" msgstr "" "enum { /* Bits that may be set in ac_flag field */\n" " AFORK = 0x01, /* Has executed fork, but no exec */\n" " ASU = 0x02, /* Used superuser privileges */\n" " ACORE = 0x08, /* Dumped core */\n" " AXSIG = 0x10 /* Killed by a signal */\n" "};\n" #. type: Plain text #: build/C/man5/acct.5:94 msgid "" "The I data type is a floating-point value consisting of a 3-bit, " "base-8 exponent, and a 13-bit mantissa. A value, I, of this type can be " "converted to a (long) integer as follows:" msgstr "" "データ型 I は浮動小数点値で、3 ビット幅の基数が 8 の指数部と 13 ビッ" "ト幅の仮数部から 構成される。 I 型の値 I は以下のようにして (long " "型の) 整数に変換できる。" #. type: Plain text #: build/C/man5/acct.5:97 #, no-wrap msgid " v = (c & 0x1fff) EE (((c EE 13) & 0x7) * 3);\n" msgstr " v = (c & 0x1fff) EE (((c EE 13) & 0x7) * 3);\n" #. type: Plain text #: build/C/man5/acct.5:107 msgid "" "The I, I, and I fields measure time in \"clock " "ticks\"; divide these values by I to convert them to " "seconds." msgstr "" "フィールド I, I, I は \"clock ticks\" 単位で計" "測した時間である。 これらの値を I で割ると、秒に変換で" "きる。" #. type: SS #: build/C/man5/acct.5:107 #, no-wrap msgid "Version 3 accounting file format" msgstr "バージョン 3 のアカウンティングファイルのフォーマット" #. type: Plain text #: build/C/man5/acct.5:122 msgid "" "Since kernel 2.6.8, an optional alternative version of the accounting file " "can be produced if the B option is set when " "building the kernel. With this option is set, the records written to the " "accounting file contain additional fields, and the width of I and " "I fields is widened from 16 to 32 bits (in line with the increased " "size of UID and GIDs in Linux 2.4 and later). The records are defined as " "follows:" msgstr "" "カーネル 2.6.8 以降では、 別のバージョンのアカウンティングファイルを生成する" "ことができ、 これを使うにはカーネル構築時に B オ" "プションが有効になっている必要がある。 このオプションが設定されると、アカウン" "ティングファイルに書き込まれる レコードにフィールドが追加される。 また、" "フィールド I と I の幅が 16 ビットから 32 ビットに拡張される " "(これは Linux 2.4 以降で UID と GID のサイズが増えているのに 対応したものであ" "る)。 このレコードは以下のように定義されている。" #. type: Plain text #: build/C/man5/acct.5:147 #, no-wrap msgid "" "struct acct_v3 {\n" " char ac_flag; /* Flags */\n" " char ac_version; /* Always set to ACCT_VERSION (3) */\n" " u_int16_t ac_tty; /* Controlling terminal */\n" " u_int32_t ac_exitcode; /* Process termination status */\n" " u_int32_t ac_uid; /* Real user ID */\n" " u_int32_t ac_gid; /* Real group ID */\n" " u_int32_t ac_pid; /* Process ID */\n" " u_int32_t ac_ppid; /* Parent process ID */\n" " u_int32_t ac_btime; /* Process creation time */\n" " float ac_etime; /* Elapsed time */\n" " comp_t ac_utime; /* User CPU time */\n" " comp_t ac_stime; /* System time */\n" " comp_t ac_mem; /* Average memory usage (kB) */\n" " comp_t ac_io; /* Characters transferred (unused) */\n" " comp_t ac_rw; /* Blocks read or written\n" " (unused) */\n" " comp_t ac_minflt; /* Minor page faults */\n" " comp_t ac_majflt; /* Major page faults */\n" " comp_t ac_swaps; /* Number of swaps (unused) */\n" " char ac_comm[ACCT_COMM]; /* Command name */\n" "};\n" msgstr "" "struct acct_v3 {\n" " char ac_flag; /* Flags */\n" " char ac_version; /* Always set to ACCT_VERSION (3) */\n" " u_int16_t ac_tty; /* Controlling terminal */\n" " u_int32_t ac_exitcode; /* Process termination status */\n" " u_int32_t ac_uid; /* Real user ID */\n" " u_int32_t ac_gid; /* Real group ID */\n" " u_int32_t ac_pid; /* Process ID */\n" " u_int32_t ac_ppid; /* Parent process ID */\n" " u_int32_t ac_btime; /* Process creation time */\n" " float ac_etime; /* Elapsed time */\n" " comp_t ac_utime; /* User CPU time */\n" " comp_t ac_stime; /* System time */\n" " comp_t ac_mem; /* Average memory usage (kB) */\n" " comp_t ac_io; /* Characters transferred (unused) */\n" " comp_t ac_rw; /* Blocks read or written\n" " (unused) */\n" " comp_t ac_minflt; /* Minor page faults */\n" " comp_t ac_majflt; /* Major page faults */\n" " comp_t ac_swaps; /* Number of swaps (unused) */\n" " char ac_comm[ACCT_COMM]; /* Command name */\n" "};\n" #. type: SH #: build/C/man5/acct.5:149 build/C/man7/cpuset.7:1338 #: build/C/man2/getresuid.2:60 build/C/man2/getrlimit.2:468 #: build/C/man2/getsid.2:75 build/C/man2/ioprio_set.2:193 #: build/C/man2/setfsgid.2:71 build/C/man2/setfsuid.2:71 #: build/C/man2/setresuid.2:81 #, no-wrap msgid "VERSIONS" msgstr "バージョン" #. type: Plain text #: build/C/man5/acct.5:153 msgid "The I structure is defined in glibc since version 2.6." msgstr "I 構造体はバージョン 2.6 以降の glibc で定義されている。" #. type: Plain text #: build/C/man5/acct.5:157 msgid "" "Process accounting originated on BSD. Although it is present on most " "systems, it is not standardized, and the details vary somewhat between " "systems." msgstr "" "プロセスアカウンティングは BSD 由来である。 この機能はほとんどのシステムに存" "在するが、標準化されておらず、 その詳細はシステムによりいくらか異なる。" #. type: Plain text #: build/C/man5/acct.5:160 msgid "" "Records in the accounting file are ordered by termination time of the " "process." msgstr "アカウンティングファイルのレコードは、プロセスの終了時刻の順序となる。" #. type: Plain text #: build/C/man5/acct.5:167 msgid "" "In kernels up to and including 2.6.9, a separate accounting record is " "written for each thread created using the NPTL threading library; since " "Linux 2.6.10, a single accounting record is written for the entire process " "on termination of the last thread in the process." msgstr "" "バージョン 2.6.9 以前のカーネルでは、 NPTL スレッドライブラリを使って作成され" "たスレッドでは スレッド毎に別々のアカウンティングレコードが書き込まれてい" "た。 Linux 2.6.10 以降では、プロセス内の最後のスレッドが終了すると、 プロセス" "全体についてのアカウンティングレコードが一つだけ書き込まれる。" #. type: Plain text #: build/C/man5/acct.5:174 msgid "" "The I file, described in B(5), defines settings " "that control the behavior of process accounting when disk space runs low." msgstr "" "I ファイル (B(5) で説明されている) は、ディスク" "容量の残りが少なくなった際の プロセス・アカウンティングの動作を制御する設定を" "保持している。" #. type: Plain text #: build/C/man5/acct.5:179 msgid "B(1), B(2), B(8), B(8)" msgstr "B(1), B(2), B(8), B(8)" #. type: TH #: build/C/man7/capabilities.7:48 #, no-wrap msgid "CAPABILITIES" msgstr "CAPABILITIES" #. type: TH #: build/C/man7/capabilities.7:48 #, no-wrap msgid "2013-09-27" msgstr "2013-09-27" #. type: Plain text #: build/C/man7/capabilities.7:51 msgid "capabilities - overview of Linux capabilities" msgstr "capabilities - Linux のケーパビリティ (capability) の概要" #. type: Plain text #: build/C/man7/capabilities.7:63 msgid "" "For the purpose of performing permission checks, traditional UNIX " "implementations distinguish two categories of processes: I " "processes (whose effective user ID is 0, referred to as superuser or root), " "and I processes (whose effective UID is nonzero). Privileged " "processes bypass all kernel permission checks, while unprivileged processes " "are subject to full permission checking based on the process's credentials " "(usually: effective UID, effective GID, and supplementary group list)." msgstr "" "権限のチェックを行う観点から見ると、伝統的な UNIX の実装では プロセスは二つの" "カテゴリに分類できる: I<特権> プロセス (実効ユーザID が 0 のプロセス。ユーザ" "ID 0 は スーパーユーザや root と呼ばれる) と I<非特権> プロセス (実効ユーザ" "ID が 0 以外のプロセス) である。 非特権プロセスでは、プロセスの資格情報 (通常" "は、実効UID 、実効GID と追加のグループリスト) に基づく権限チェックが行われる" "のに対し、 特権プロセスでは全てのカーネルの権限チェックがバイパスされる。" #. type: Plain text #: build/C/man7/capabilities.7:70 msgid "" "Starting with kernel 2.2, Linux divides the privileges traditionally " "associated with superuser into distinct units, known as I, " "which can be independently enabled and disabled. Capabilities are a per-" "thread attribute." msgstr "" "バージョン 2.2 以降の Linux では、 これまでスーパーユーザに結び付けられてきた" "権限を、 いくつかのグループに分割している。これらのグループは I<ケーパビリ" "ティ>(capability) と呼ばれ、グループ毎に独立に有効、無効を設定できる。 ケー" "パビリティはスレッド単位の属性である。" #. type: SS #: build/C/man7/capabilities.7:70 #, no-wrap msgid "Capabilities list" msgstr "ケーパビリティのリスト" #. type: Plain text #: build/C/man7/capabilities.7:73 msgid "" "The following list shows the capabilities implemented on Linux, and the " "operations or behaviors that each capability permits:" msgstr "" "以下のリストは、 Linux で実装されているケーパビリティと 各ケーパビリティが許" "可する操作と動作をまとめたものである。" #. type: TP #: build/C/man7/capabilities.7:73 #, no-wrap msgid "B (since Linux 2.6.11)" msgstr "B (Linux 2.6.11 以降)" #. type: Plain text #: build/C/man7/capabilities.7:77 msgid "" "Enable and disable kernel auditing; change auditing filter rules; retrieve " "auditing status and filtering rules." msgstr "" "カーネル監査 (audit) の有効無効の切り替え、 監査のフィルタルールの変更、 監査" "の状況やフィルタルールの取得ができる。" #. type: TP #: build/C/man7/capabilities.7:77 #, no-wrap msgid "B (since Linux 2.6.11)" msgstr "B (Linux 2.6.11 以降)" #. type: Plain text #: build/C/man7/capabilities.7:80 msgid "Write records to kernel auditing log." msgstr "カーネル監査のログにレコードを書き込む。" #. type: TP #: build/C/man7/capabilities.7:80 #, no-wrap msgid "B (since Linux 3.5)" msgstr "B (Linux 3.5 以降)" #. type: Plain text #: build/C/man7/capabilities.7:86 msgid "" "Employ features that can block system suspend (B(7) B, " "I)." msgstr "" "システムのサスペンドをブロックできる機能を使用する (B(7) " "B, I)。" #. type: TP #: build/C/man7/capabilities.7:86 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:90 msgid "Make arbitrary changes to file UIDs and GIDs (see B(2))." msgstr "ファイルの UID とGID を任意に変更する (B(2) 参照)。" #. type: TP #: build/C/man7/capabilities.7:90 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:94 msgid "" "Bypass file read, write, and execute permission checks. (DAC is an " "abbreviation of \"discretionary access control\".)" msgstr "" "ファイルの読み出し、書き込み、実行の権限チェックをバイパスする (DAC は " "\"discretionary access control (任意のアクセス制御)\" の略である)。" #. type: TP #: build/C/man7/capabilities.7:94 #, no-wrap msgid "B" msgstr "B" #. type: IP #: build/C/man7/capabilities.7:98 build/C/man7/capabilities.7:101 #: build/C/man7/capabilities.7:111 build/C/man7/capabilities.7:121 #: build/C/man7/capabilities.7:125 build/C/man7/capabilities.7:127 #: build/C/man7/capabilities.7:129 build/C/man7/capabilities.7:199 #: build/C/man7/capabilities.7:201 build/C/man7/capabilities.7:203 #: build/C/man7/capabilities.7:205 build/C/man7/capabilities.7:207 #: build/C/man7/capabilities.7:209 build/C/man7/capabilities.7:211 #: build/C/man7/capabilities.7:213 build/C/man7/capabilities.7:215 #: build/C/man7/capabilities.7:239 build/C/man7/capabilities.7:241 #: build/C/man7/capabilities.7:287 build/C/man7/capabilities.7:297 #: build/C/man7/capabilities.7:303 build/C/man7/capabilities.7:308 #: build/C/man7/capabilities.7:314 build/C/man7/capabilities.7:321 #: build/C/man7/capabilities.7:324 build/C/man7/capabilities.7:332 #: build/C/man7/capabilities.7:334 build/C/man7/capabilities.7:343 #: build/C/man7/capabilities.7:350 build/C/man7/capabilities.7:353 #: build/C/man7/capabilities.7:357 build/C/man7/capabilities.7:360 #: build/C/man7/capabilities.7:363 build/C/man7/capabilities.7:370 #: build/C/man7/capabilities.7:375 build/C/man7/capabilities.7:381 #: build/C/man7/capabilities.7:385 build/C/man7/capabilities.7:389 #: build/C/man7/capabilities.7:393 build/C/man7/capabilities.7:397 #: build/C/man7/capabilities.7:424 build/C/man7/capabilities.7:429 #: build/C/man7/capabilities.7:434 build/C/man7/capabilities.7:437 #: build/C/man7/capabilities.7:440 build/C/man7/capabilities.7:449 #: build/C/man7/capabilities.7:453 build/C/man7/capabilities.7:479 #: build/C/man7/capabilities.7:484 build/C/man7/capabilities.7:487 #: build/C/man7/capabilities.7:492 build/C/man7/capabilities.7:495 #: build/C/man7/capabilities.7:498 build/C/man7/capabilities.7:501 #: build/C/man7/capabilities.7:504 build/C/man7/capabilities.7:509 #: build/C/man7/capabilities.7:511 build/C/man7/capabilities.7:517 #: build/C/man7/capabilities.7:525 build/C/man7/capabilities.7:527 #: build/C/man7/capabilities.7:531 build/C/man7/capabilities.7:533 #: build/C/man7/capabilities.7:536 build/C/man7/capabilities.7:540 #: build/C/man7/capabilities.7:542 build/C/man7/capabilities.7:544 #: build/C/man7/capabilities.7:546 build/C/man7/capabilities.7:555 #: build/C/man7/capabilities.7:562 build/C/man7/capabilities.7:567 #: build/C/man7/capabilities.7:572 build/C/man7/capabilities.7:577 #: build/C/man7/capabilities.7:600 build/C/man7/capabilities.7:607 #: build/C/man7/capabilities.7:806 build/C/man7/capabilities.7:814 #: build/C/man7/capabilities.7:1130 build/C/man7/capabilities.7:1135 #: build/C/man7/cpuset.7:540 build/C/man7/cpuset.7:545 #: build/C/man7/cpuset.7:550 build/C/man7/cpuset.7:726 #: build/C/man7/cpuset.7:730 build/C/man7/cpuset.7:927 #: build/C/man7/cpuset.7:930 build/C/man7/cpuset.7:934 #: build/C/man7/cpuset.7:938 build/C/man7/cpuset.7:942 #: build/C/man7/credentials.7:177 build/C/man7/credentials.7:183 #: build/C/man7/credentials.7:195 build/C/man7/credentials.7:217 #: build/C/man7/credentials.7:234 build/C/man7/credentials.7:266 #: build/C/man7/credentials.7:269 build/C/man7/credentials.7:279 #: build/C/man7/credentials.7:282 #, no-wrap msgid "*" msgstr "*" #. type: Plain text #: build/C/man7/capabilities.7:101 msgid "" "Bypass file read permission checks and directory read and execute permission " "checks;" msgstr "" "ファイルの読み出し権限のチェックとディレクトリの読み出しと実行 の権限チェック" "をバイパスする。" #. type: Plain text #: build/C/man7/capabilities.7:104 msgid "Invoke B(2)." msgstr "B(2) を起動する。" #. type: TP #: build/C/man7/capabilities.7:107 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:121 msgid "" "Bypass permission checks on operations that normally require the filesystem " "UID of the process to match the UID of the file (e.g., B(2), B" "(2)), excluding those operations covered by B and " "B;" msgstr "" "通常、プロセスのファイルシステム UID がファイルの UID に一致することが 要求さ" "れる操作 (例えば B(2), B(2)) における権限チェックをバイパスす" "る。 但し、 B か B によりチェックが行" "われる操作は除く。" #. type: Plain text #: build/C/man7/capabilities.7:125 msgid "set extended file attributes (see B(1)) on arbitrary files;" msgstr "" "任意のファイルに対して拡張ファイル属性を設定する (B(1) 参照)。" #. type: Plain text #: build/C/man7/capabilities.7:127 msgid "set Access Control Lists (ACLs) on arbitrary files;" msgstr "任意のファイルに対してアクセス制御リスト (ACL) を設定する。" #. type: Plain text #: build/C/man7/capabilities.7:129 msgid "ignore directory sticky bit on file deletion;" msgstr "ファイルの削除の際にディレクトリのスティッキービットを無視する。" #. type: Plain text #: build/C/man7/capabilities.7:136 msgid "" "specify B for arbitrary files in B(2) and B(2)." msgstr "" "B(2) や B(2) で任意のファイルに対して B を指定す" "る。" #. type: TP #: build/C/man7/capabilities.7:138 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:144 msgid "" "Don't clear set-user-ID and set-group-ID permission bits when a file is " "modified; set the set-group-ID bit for a file whose GID does not match the " "filesystem or any of the supplementary GIDs of the calling process." msgstr "" "ファイルが変更されたときに set-user-ID とset-group-ID の許可ビットをクリア し" "ない。呼び出し元プロセスのファイルシステム GID と追加の GID のいずれとも GID " "が一致しないファイルに対して set-group-ID ビットを設定する。" #. type: TP #: build/C/man7/capabilities.7:144 #, no-wrap msgid "B" msgstr "B" #. FIXME As at Linux 3.2, there are some strange uses of this capability #. in other places; they probably should be replaced with something else. #. type: Plain text #: build/C/man7/capabilities.7:153 msgid "Lock memory (B(2), B(2), B(2), B(2))." msgstr "" "メモリーのロック (B(2), B(2), B(2), B(2)) を" "行う。" #. type: TP #: build/C/man7/capabilities.7:153 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:156 msgid "Bypass permission checks for operations on System V IPC objects." msgstr "" "System V IPC オブジェクトに対する操作に関して権限チェックをバイパスする。" #. type: TP #: build/C/man7/capabilities.7:156 #, no-wrap msgid "B" msgstr "B" #. FIXME CAP_KILL also has an effect for threads + setting child #. termination signal to other than SIGCHLD: without this #. capability, the termination signal reverts to SIGCHLD #. if the child does an exec(). What is the rationale #. for this? #. type: Plain text #: build/C/man7/capabilities.7:169 msgid "" "Bypass permission checks for sending signals (see B(2)). This " "includes use of the B(2) B operation." msgstr "" "シグナルを送信する際に権限チェックをバイパスする (B(2) 参照)。これに" "は B(2) の B 操作の使用も含まれる。" #. type: TP #: build/C/man7/capabilities.7:169 #, no-wrap msgid "B (since Linux 2.4)" msgstr "B (Linux 2.4 以降)" #. type: Plain text #: build/C/man7/capabilities.7:173 msgid "Establish leases on arbitrary files (see B(2))." msgstr "任意のファイルに対して ファイルリースを設定する (B(2) 参照)。" #. type: TP #: build/C/man7/capabilities.7:173 #, no-wrap msgid "B" msgstr "B" #. These attributes are now available on ext2, ext3, Reiserfs, XFS, JFS #. type: Plain text #: build/C/man7/capabilities.7:182 msgid "" "Set the B and B i-node flags (see B" "(1))." msgstr "" "拡張ファイル属性 B と B を設定する (B" "(1) 参照)。" #. type: TP #: build/C/man7/capabilities.7:182 #, no-wrap msgid "B (since Linux 2.6.25)" msgstr "B (Linux 2.6.25 以降)" #. type: Plain text #: build/C/man7/capabilities.7:186 msgid "" "Override Mandatory Access Control (MAC). Implemented for the Smack Linux " "Security Module (LSM)." msgstr "" "強制アクセス制御 (MAC) を上書きする。 Smack Linux Security Module (LSM) 用に" "実装されている。" #. type: TP #: build/C/man7/capabilities.7:186 #, no-wrap msgid "B (since Linux 2.6.25)" msgstr "B (Linux 2.6.25 以降)" #. type: Plain text #: build/C/man7/capabilities.7:190 msgid "" "Allow MAC configuration or state changes. Implemented for the Smack LSM." msgstr "MAC の設定や状態を変更する。 Smack LSM 用に実装されている。" #. type: TP #: build/C/man7/capabilities.7:190 #, no-wrap msgid "B (since Linux 2.4)" msgstr "B (Linux 2.4 以降)" #. type: Plain text #: build/C/man7/capabilities.7:194 msgid "Create special files using B(2)." msgstr "" "(Linux 2.4 以降) B(2) を使用してスペシャルファイルを作成する。" #. type: TP #: build/C/man7/capabilities.7:194 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:197 msgid "Perform various network-related operations:" msgstr "各種のネットワーク関係の操作を実行する:" #. type: Plain text #: build/C/man7/capabilities.7:201 msgid "interface configuration;" msgstr "インターフェースの設定" #. type: Plain text #: build/C/man7/capabilities.7:203 msgid "administration of IP firewall, masquerading, and accounting;" msgstr "IP のファイアウォール、マスカレード、アカウンティング" #. type: Plain text #: build/C/man7/capabilities.7:205 msgid "modify routing tables;" msgstr "ルーティングテーブルの変更" #. type: Plain text #: build/C/man7/capabilities.7:207 msgid "bind to any address for transparent proxying;" msgstr "透過的プロキシでの任意のアドレスの割り当て (bind)" #. type: Plain text #: build/C/man7/capabilities.7:209 msgid "set type-of-service (TOS)" msgstr "サービス種別 (type-of-service; TOS) のセット" #. type: Plain text #: build/C/man7/capabilities.7:211 msgid "clear driver statistics;" msgstr "ドライバの統計情報のクリア" #. type: Plain text #: build/C/man7/capabilities.7:213 msgid "set promiscuous mode;" msgstr "promiscuous モードをセットする" #. type: Plain text #: build/C/man7/capabilities.7:215 msgid "enabling multicasting;" msgstr "マルチキャストを有効にする" #. type: Plain text #: build/C/man7/capabilities.7:226 msgid "" "use B(2) to set the following socket options: B, " "B, B (for a priority outside the range 0 to 6), " "B, and B." msgstr "" "B(2) を使って以下のソケットオプションを設定する:\n" "B, B, \n" "B (優先度を 0 から 6 以外に設定する場合),\n" "B, and B" #. type: TP #: build/C/man7/capabilities.7:228 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:232 msgid "" "Bind a socket to Internet domain privileged ports (port numbers less than " "1024)." msgstr "" "インターネットドメインの特権ポート (ポート番号が 1024 番未満) をバインドでき" "る。" #. type: TP #: build/C/man7/capabilities.7:232 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:235 msgid "(Unused) Make socket broadcasts, and listen to multicasts." msgstr "" "(未使用) ソケットのブロードキャストと、マルチキャストの待ち受けを行う。" #. type: TP #: build/C/man7/capabilities.7:235 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:241 msgid "use RAW and PACKET sockets;" msgstr "RAW ソケットと PACKET ソケットを使用する。" #. type: Plain text #: build/C/man7/capabilities.7:243 msgid "bind to any address for transparent proxying." msgstr "透過的プロキシでの任意のアドレスの割り当て (bind)" #. type: TP #: build/C/man7/capabilities.7:246 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:250 msgid "" "Make arbitrary manipulations of process GIDs and supplementary GID list; " "forge GID when passing socket credentials via UNIX domain sockets." msgstr "" "プロセスの GID と追加の GID リストに対する任意の操作を行う。 UNIX ドメインソ" "ケット経由でソケットの資格情報 (credential) を渡す際に 偽の GID を渡すことが" "できる。" #. type: TP #: build/C/man7/capabilities.7:250 #, no-wrap msgid "B (since Linux 2.6.24)" msgstr "B (Linux 2.6.24 以降)" #. type: Plain text #: build/C/man7/capabilities.7:253 msgid "Set file capabilities." msgstr "ファイルケーパビリティを設定する。" #. type: TP #: build/C/man7/capabilities.7:253 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:264 msgid "" "If file capabilities are not supported: grant or remove any capability in " "the caller's permitted capability set to or from any other process. (This " "property of B is not available when the kernel is configured to " "support file capabilities, since B has entirely different " "semantics for such kernels.)" msgstr "" "ファイルケーパビリティがサポートされていない場合: 呼び出し元が許可されている" "ケーパビリティセットに含まれる任意のケーパビリティを、 他のプロセスに付与した" "り、削除したりできる。 (カーネルがファイルケーパビリティをサポートしている場" "合、 B はこの役割を持たない。 なぜなら、ファイルケーパビリティを" "サポートしているカーネルでは B は全く別の意味を持つからである。)" #. type: Plain text #: build/C/man7/capabilities.7:274 msgid "" "If file capabilities are supported: add any capability from the calling " "thread's bounding set to its inheritable set; drop capabilities from the " "bounding set (via B(2) B); make changes to the " "I flags." msgstr "" "ファイルケーパビリティがサポートされている場合: 呼び出し元スレッドのバウン" "ディングセットの任意のケーパビリティを 自身の継承可能ケーパビリティセットに追" "加できる。 (B(2) B を使って) バウンディングセットか" "らケーパビリティを削除できる。 I フラグを変更できる。" #. type: TP #: build/C/man7/capabilities.7:274 #, no-wrap msgid "B" msgstr "B" #. FIXME CAP_SETUID also an effect in exec(); document this. #. type: Plain text #: build/C/man7/capabilities.7:283 msgid "" "Make arbitrary manipulations of process UIDs (B(2), B(2), " "B(2), B(2)); make forged UID when passing socket " "credentials via UNIX domain sockets." msgstr "" "プロセスの UID に対する任意の操作 (B(2), B(2), B" "(2), B(2)) を行う。 UNIX ドメインソケット経由でソケットの資格情報 " "(credential) を渡す際に 偽の UID を渡すことができる。" #. type: TP #: build/C/man7/capabilities.7:283 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:297 msgid "" "Perform a range of system administration operations including: B" "(2), B(2), B(2), B(2), B(2), B" "(2), and B(2);" msgstr "" "以下のシステム管理用の操作を実行する: B(2), B(2), B" "(2), B(2), B(2), B(2), B(2)." #. type: Plain text #: build/C/man7/capabilities.7:303 msgid "" "perform privileged B(2) operations (since Linux 2.6.37, " "B should be used to permit such operations);" msgstr "" "特権が必要な B(2) の操作を実行する\n" "(Linux 2.6.37 以降では、このような操作を許可するには\n" "B を使うべきである)" #. type: Plain text #: build/C/man7/capabilities.7:308 msgid "perform B B(2) command;" msgstr "B B(2) コマンドを実行する。" #. type: Plain text #: build/C/man7/capabilities.7:314 msgid "" "perform B and B operations on arbitrary System V IPC " "objects;" msgstr "" "任意の System V IPC オブジェクトに対する B と B 操作を実行" "する。" #. type: Plain text #: build/C/man7/capabilities.7:321 msgid "" "perform operations on I and I Extended Attributes (see " "B(5));" msgstr "" "拡張属性 I と I に対する操作を実行する (B(5) 参" "照)。" #. type: Plain text #: build/C/man7/capabilities.7:324 msgid "use B(2);" msgstr "B(2) を呼び出す。" #. type: Plain text #: build/C/man7/capabilities.7:332 msgid "" "use B(2) to assign B and (before Linux " "2.6.25) B I/O scheduling classes;" msgstr "" "B(2) を使って I/O スケジューリングクラス B, " "B を割り当てる (B は Linux 2.6.25 より" "前のバージョンのみ)。" #. type: Plain text #: build/C/man7/capabilities.7:334 msgid "forge UID when passing socket credentials;" msgstr "ソケットの資格情報 (credential) を渡す際に偽の UID を渡す。" #. type: Plain text #: build/C/man7/capabilities.7:343 msgid "" "exceed I, the system-wide limit on the number of open " "files, in system calls that open files (e.g., B(2), B(2), " "B(2), B(2));" msgstr "" "ファイルをオープンするシステムコール (例えば B(2), B(2), " "B(2), B(2)) でシステム全体でオープンできるファイル数の上限 I を超過する。" #. type: Plain text #: build/C/man7/capabilities.7:350 msgid "" "employ B flags that create new namespaces with B(2) and " "B(2);" msgstr "" "B(2) と B(2) で新しい名前空間を作成する B \n" "フラグを利用する。" #. type: Plain text #: build/C/man7/capabilities.7:353 msgid "call B(2);" msgstr "B(2) を呼び出す。" #. type: Plain text #: build/C/man7/capabilities.7:357 msgid "access privileged I event information;" msgstr "特権が必要な I イベントの情報にアクセスする。" #. type: Plain text #: build/C/man7/capabilities.7:360 msgid "call B(2);" msgstr "B(2) を呼び出す。" #. type: Plain text #: build/C/man7/capabilities.7:363 msgid "call B(2);" msgstr "B(2) を呼び出す。" #. type: Plain text #: build/C/man7/capabilities.7:370 msgid "perform B and B B(2) operations;" msgstr "B(2) の B と B 操作を実行する。" #. type: Plain text #: build/C/man7/capabilities.7:375 msgid "perform B(2) B operation;" msgstr "B(2) の B 操作を実行する。" #. type: Plain text #: build/C/man7/capabilities.7:381 msgid "" "employ the B B(2) to insert characters into the input queue " "of a terminal other than the caller's controlling terminal." msgstr "" "B B(2) を使って、\n" "呼び出し元の制御端末以外の端末の入力キューに文字を挿入する。" #. type: Plain text #: build/C/man7/capabilities.7:385 msgid "employ the obsolete B(2) system call;" msgstr "廃止予定の B(2) システムコールを使用する。" #. type: Plain text #: build/C/man7/capabilities.7:389 msgid "employ the obsolete B(2) system call;" msgstr "廃止予定の B(2) システムコールを使用する。" #. type: Plain text #: build/C/man7/capabilities.7:393 msgid "perform various privileged block-device B(2) operations;" msgstr "" "特権が必要なブロックデバイスに対する各種の B(2) 操作を\n" "実行する。" #. type: Plain text #: build/C/man7/capabilities.7:397 msgid "perform various privileged filesystem B(2) operations;" msgstr "" "特権が必要なファイルシステムに対する各種の B(2) 操作を\n" "実行する。" #. type: Plain text #: build/C/man7/capabilities.7:399 msgid "perform administrative operations on many device drivers." msgstr "多くのデバイスドライバに対する管理命令を実行する。" #. type: TP #: build/C/man7/capabilities.7:401 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:407 msgid "Use B(2) and B(2)." msgstr "B(2) と B(2) を呼び出す。" #. type: TP #: build/C/man7/capabilities.7:407 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:411 msgid "Use B(2)." msgstr "B(2). を呼び出す。" #. type: TP #: build/C/man7/capabilities.7:411 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:420 msgid "" "Load and unload kernel modules (see B(2) and B" "(2)); in kernels before 2.6.25: drop capabilities from the system-wide " "capability bounding set." msgstr "" "カーネルモジュールのロード、アンロードを行う (B(2) と " "B(2) を参照のこと)。 バージョン 2.6.25 より前のカーネルで、 " "システム全体のケーパビリティバウンディングセット (capability bounding set) " "からケーパビリティを外す。" #. type: TP #: build/C/man7/capabilities.7:420 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:429 msgid "" "Raise process nice value (B(2), B(2)) and change the " "nice value for arbitrary processes;" msgstr "" "プロセスの nice 値の引き上げ (B(2), B(2)) や、任意のプロ" "セスの nice 値の変更を行う。" #. type: Plain text #: build/C/man7/capabilities.7:434 msgid "" "set real-time scheduling policies for calling process, and set scheduling " "policies and priorities for arbitrary processes (B(2), " "B(2));" msgstr "" "呼び出し元プロセスに対するリアルタイムスケジューリングポリシーと、 任意のプロ" "セスに対するスケジューリングポリシーと優先度を設定する (B" "(2), B(2))。" #. type: Plain text #: build/C/man7/capabilities.7:437 msgid "set CPU affinity for arbitrary processes (B(2));" msgstr "" "任意のプロセスに対する CPU affinity を設定できる (B(2))。" #. type: Plain text #: build/C/man7/capabilities.7:440 msgid "" "set I/O scheduling class and priority for arbitrary processes (B" "(2));" msgstr "" "任意のプロセスに対して I/O スケジューリングクラスと優先度を設定できる " "(B(2))。" #. FIXME CAP_SYS_NICE also has the following effect for #. migrate_pages(2): #. do_migrate_pages(mm, &old, &new, #. capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE); #. type: Plain text #: build/C/man7/capabilities.7:449 msgid "" "apply B(2) to arbitrary processes and allow processes to be " "migrated to arbitrary nodes;" msgstr "" "B(2) を任意のプロセスに適用し、プロセスを任意のノードに移動す" "る。" #. type: Plain text #: build/C/man7/capabilities.7:453 msgid "apply B(2) to arbitrary processes;" msgstr "B(2) を任意のプロセスに対して行う。" #. type: Plain text #: build/C/man7/capabilities.7:460 msgid "" "use the B flag with B(2) and B(2)." msgstr "" "B(2) と B(2) で B フラグを使用する。" #. type: TP #: build/C/man7/capabilities.7:462 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:466 msgid "Use B(2)." msgstr "B(2) を呼び出す。" #. type: TP #: build/C/man7/capabilities.7:466 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:475 msgid "" "Trace arbitrary processes using B(2); apply B(2) " "to arbitrary processes; inspect processes using B(2)." msgstr "" "B(2) を使って任意のプロセスをトレースする。 任意のプロセスに " "B(2) を適用する。 B(2) を使ってプロセス内部を調査す" "る。" #. type: TP #: build/C/man7/capabilities.7:475 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:484 msgid "Perform I/O port operations (B(2) and B(2));" msgstr "I/O ポート操作を実行する (B(2)、 B(2))。" #. type: Plain text #: build/C/man7/capabilities.7:487 msgid "access I;" msgstr "I にアクセスする。" #. type: Plain text #: build/C/man7/capabilities.7:492 msgid "employ the B B(2) operation;" msgstr "B B(2) 操作を使用する。" #. type: Plain text #: build/C/man7/capabilities.7:495 msgid "" "open devices for accessing x86 model-specific registers (MSRs, see B(4))" msgstr "" "x86 モデルに固有のレジスタ (MSR レジスタ群、 B(4) 参照) にアクセスするた" "めのデバイスをオープンする。" #. type: Plain text #: build/C/man7/capabilities.7:498 msgid "update I;" msgstr "I を更新する。" #. type: Plain text #: build/C/man7/capabilities.7:501 msgid "" "create memory mappings at addresses below the value specified by I;" msgstr "" "I で指定された値よりも小さなアドレスにメモリマッ" "ピングを作成する。" #. type: Plain text #: build/C/man7/capabilities.7:504 msgid "map files in I;" msgstr "I にあるファイルをマップする。" #. type: Plain text #: build/C/man7/capabilities.7:509 msgid "open I and I;" msgstr "I や I をオープンする。" #. type: Plain text #: build/C/man7/capabilities.7:511 msgid "perform various SCSI device commands;" msgstr "各種の SCSI デバイスコマンドを実行する。" #. type: Plain text #: build/C/man7/capabilities.7:517 msgid "perform certain operations on B(4) and B(4) devices;" msgstr "B(4) デバイスや B(4) デバイスの特定の操作を実行する。" #. type: Plain text #: build/C/man7/capabilities.7:519 msgid "perform a range of device-specific operations on other devices." msgstr "他のデバイスに対して各種のデバイス固有命令を実行する。" #. type: TP #: build/C/man7/capabilities.7:521 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:527 msgid "Use reserved space on ext2 filesystems;" msgstr "ext2 ファイルシステム上の予約されている領域を使用する。" #. type: Plain text #: build/C/man7/capabilities.7:531 msgid "make B(2) calls controlling ext3 journaling;" msgstr "ext3 のジャーナル機能を制御する B(2) を使用する。" #. type: Plain text #: build/C/man7/capabilities.7:533 msgid "override disk quota limits;" msgstr "ディスク quota の上限を上書きする。" #. type: Plain text #: build/C/man7/capabilities.7:536 msgid "increase resource limits (see B(2));" msgstr "リソース上限を増やす (B(2))。" #. type: Plain text #: build/C/man7/capabilities.7:540 msgid "override B resource limit;" msgstr "B リソース制限を上書きする。" #. type: Plain text #: build/C/man7/capabilities.7:542 msgid "override maximum number of consoles on console allocation;" msgstr "コンソール割り当てにおいてコンソールの最大数を上書きする。" #. type: Plain text #: build/C/man7/capabilities.7:544 msgid "override maximum number of keymaps;" msgstr "キーマップの最大数を上書きする。" #. type: Plain text #: build/C/man7/capabilities.7:546 msgid "allow more than 64hz interrupts from the real-time clock;" msgstr "リアルタイムクロックから秒間 64 回を越える回数の割り当てが許可する。" #. type: Plain text #: build/C/man7/capabilities.7:555 msgid "" "raise I limit for a System V message queue above the limit in I (see B(2) and B(2));" msgstr "" "メッセージキューに関する上限 I を \n" "I に指定されている上限よりも大きく設定する\n" "(B(2) と B(2) 参照)。" #. type: Plain text #: build/C/man7/capabilities.7:562 msgid "" "override the I limit when setting the capacity " "of a pipe using the B B(2) command." msgstr "" "B B(2) を使ってパイプの容量を設定する際に\n" "上限 I を上書きする。" #. type: Plain text #: build/C/man7/capabilities.7:567 msgid "" "use B to increase the capacity of a pipe above the limit " "specified by I;" msgstr "" "I に指定されている上限を超えてパイプの容量\n" "を増やすのに B を使用する。" #. type: Plain text #: build/C/man7/capabilities.7:572 msgid "" "override I limit when creating POSIX message " "queues (see B(7));" msgstr "" "POSIX メッセージキューを作成する際に、\n" "上限 I を上書きする\n" "(B(7) 参照)。" #. type: Plain text #: build/C/man7/capabilities.7:577 msgid "employ B(2) B operation;" msgstr "B(2) B 操作を使用する。" #. type: Plain text #: build/C/man7/capabilities.7:582 msgid "" "set I to a value lower than the value last set by a " "process with B." msgstr "" "B を持ったプロセスによって最後に設定された値よりも小さな値" "を I に設定する。" #. type: TP #: build/C/man7/capabilities.7:584 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:591 msgid "" "Set system clock (B(2), B(2), B(2)); set real-" "time (hardware) clock." msgstr "" "システムクロックを変更する (B(2), B(2), B" "(2))。 リアルタイム (ハードウェア) クロックを変更する。" #. type: TP #: build/C/man7/capabilities.7:591 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:598 msgid "" "Use B(2); employ various privileged B(2) operations on " "virtual terminals." msgstr "" "B(2) を使用する。\n" "特権が必要な仮想端末に関する各種の B(2) 操作を利用できる。" #. type: TP #: build/C/man7/capabilities.7:598 #, no-wrap msgid "B (since Linux 2.6.37)" msgstr "B (Linux 2.6.37 以降)" #. type: Plain text #: build/C/man7/capabilities.7:607 msgid "" "Perform privileged B(2) operations. See B(2) for " "information on which operations require privilege." msgstr "" "特権が必要な B(2) 操作を実行できる。\n" "どの操作が特権が必要かについての情報は B(2) を参照。" #. type: Plain text #: build/C/man7/capabilities.7:617 msgid "" "View kernel addresses exposed via I and other interfaces when I has the value 1. (See the discussion of the " "I in B(5).)" msgstr "" "I の値が 1 の場合、 I や他のインター" "フェース経由で公開されているカーネルアドレスを参照する (B(5) の " "I の議論を参照)。" #. type: TP #: build/C/man7/capabilities.7:617 #, no-wrap msgid "B (since Linux 3.0)" msgstr "B (Linux 3.0 以降)" #. type: Plain text #: build/C/man7/capabilities.7:625 msgid "" "Trigger something that will wake up the system (set B " "and B timers)." msgstr "" "システムを起こすトリガーを有効にする (タイマー B\n" "や B を設定する)。" #. type: SS #: build/C/man7/capabilities.7:625 #, no-wrap msgid "Past and current implementation" msgstr "過去と現在の実装" #. type: Plain text #: build/C/man7/capabilities.7:627 msgid "A full implementation of capabilities requires that:" msgstr "完全な形のケーパビリティを実装するには、以下の要件を満たす必要がある：" #. type: IP #: build/C/man7/capabilities.7:627 build/C/man7/capabilities.7:778 #: build/C/man7/capabilities.7:925 build/C/man7/capabilities.7:978 #, no-wrap msgid "1." msgstr "1." #. type: Plain text #: build/C/man7/capabilities.7:631 msgid "" "For all privileged operations, the kernel must check whether the thread has " "the required capability in its effective set." msgstr "" "全ての特権操作について、カーネルはそのスレッドの実効ケーパビリティセットに 必" "要なケーパビリティがあるかを確認する。" #. type: IP #: build/C/man7/capabilities.7:631 build/C/man7/capabilities.7:783 #: build/C/man7/capabilities.7:931 build/C/man7/capabilities.7:984 #, no-wrap msgid "2." msgstr "2." #. type: Plain text #: build/C/man7/capabilities.7:634 msgid "" "The kernel must provide system calls allowing a thread's capability sets to " "be changed and retrieved." msgstr "" "カーネルで、あるスレッドのケーパビリティセットを変更したり、 取得したりできる" "システムコールが提供される。" #. type: IP #: build/C/man7/capabilities.7:634 build/C/man7/capabilities.7:934 #: build/C/man7/capabilities.7:988 #, no-wrap msgid "3." msgstr "3." #. type: Plain text #: build/C/man7/capabilities.7:637 msgid "" "The filesystem must support attaching capabilities to an executable file, so " "that a process gains those capabilities when the file is executed." msgstr "" "ファイルシステムが、実行可能ファイルにケーパビリティを付与でき、ファイル 実行" "時にそのケーパビリティをプロセスが取得できるような機能をサポートする。" #. type: Plain text #: build/C/man7/capabilities.7:641 msgid "" "Before kernel 2.6.24, only the first two of these requirements are met; " "since kernel 2.6.24, all three requirements are met." msgstr "" "カーネル 2.6.24 より前では、最初の 2つの要件のみが満たされている。 カーネル " "2.6.24 以降では、3つの要件すべてが満たされている。" #. type: SS #: build/C/man7/capabilities.7:641 #, no-wrap msgid "Thread capability sets" msgstr "スレッドケーパビリティセット" #. type: Plain text #: build/C/man7/capabilities.7:644 msgid "" "Each thread has three capability sets containing zero or more of the above " "capabilities:" msgstr "" "各スレッドは以下の 3種類のケーパビリティセットを持つ。各々のケーパビリティ" "セットは 上記のケーパビリティの組み合わせである (全てのケーパビリティが無効で" "もよい)。" #. type: TP #: build/C/man7/capabilities.7:644 #, no-wrap msgid "I:" msgstr "I<許可 (permitted)>:" #. type: Plain text #: build/C/man7/capabilities.7:652 msgid "" "This is a limiting superset for the effective capabilities that the thread " "may assume. It is also a limiting superset for the capabilities that may be " "added to the inheritable set by a thread that does not have the " "B capability in its effective set." msgstr "" "そのスレッドが持つことになっている実効ケーパビリティの 限定的なスーパーセット" "である。 これは、実効ケーパビリティセットに B ケーパビリティを" "持っていないスレッドが継承可能ケーパビリティセットに 追加可能なケーパビリティ" "の限定的なスーパーセットでもある。" #. type: Plain text #: build/C/man7/capabilities.7:658 msgid "" "If a thread drops a capability from its permitted set, it can never " "reacquire that capability (unless it B(2)s either a set-user-ID-root " "program, or a program whose associated file capabilities grant that " "capability)." msgstr "" "許可ケーパビリティセットから削除してしまったケーパビリティは、 (set-user-ID-" "root プログラムか、 そのケーパビリティをファイルケーパビリティで許可している" "プログラムを B(2) しない限りは) もう一度獲得することはできない。" #. type: TP #: build/C/man7/capabilities.7:658 #, no-wrap msgid "I:" msgstr "I<継承可能 (inheritable)>:" #. type: Plain text #: build/C/man7/capabilities.7:665 msgid "" "This is a set of capabilities preserved across an B(2). It provides " "a mechanism for a process to assign capabilities to the permitted set of the " "new program during an B(2)." msgstr "" "B(2) を前後で保持されるケーパビリティセットである。 この仕組みを使う" "ことで、あるプロセスが B(2) を行う際に新しいプログラムの許可ケーパビ" "リティセットとして 割り当てるケーパビリティを指定することができる。" #. type: TP #: build/C/man7/capabilities.7:665 build/C/man7/capabilities.7:715 #, no-wrap msgid "I:" msgstr "I<実効 (effective)>:" #. type: Plain text #: build/C/man7/capabilities.7:669 msgid "" "This is the set of capabilities used by the kernel to perform permission " "checks for the thread." msgstr "" "カーネルがスレッドの権限 (permission) をチェックするときに 使用するケーパビリ" "ティセットである。" #. type: Plain text #: build/C/man7/capabilities.7:675 msgid "" "A child created via B(2) inherits copies of its parent's capability " "sets. See below for a discussion of the treatment of capabilities during " "B(2)." msgstr "" "B(2) で作成される子プロセスは、親のケーパビリティセットのコピーを継承" "する。 B(2) 中のケーパビリティの扱いについては下記を参照のこと。" #. type: Plain text #: build/C/man7/capabilities.7:679 msgid "" "Using B(2), a thread may manipulate its own capability sets (see " "below)." msgstr "" "B(2) を使うと、プロセスは自分自身のケーパビリティセット を操作するこ" "とができる (下記参照)。" #. commit 73efc0394e148d0e15583e13712637831f926720 #. type: Plain text #: build/C/man7/capabilities.7:688 msgid "" "Since Linux 3.2, the file I exposes the " "numerical value of the highest capability supported by the running kernel; " "this can be used to determine the highest bit that may be set in a " "capability set." msgstr "" "Linux 3.2 以降では、 ファイル I で、 実行中の" "カーネルでサポートされているケーパビリティの最大値を参照できる。 この情報を" "使って、 ケーパビリティセットに設定される可能性がある最上位ビットを判定するこ" "とができる。" #. type: SS #: build/C/man7/capabilities.7:688 #, no-wrap msgid "File capabilities" msgstr "ファイルケーパビリティ" #. type: Plain text #: build/C/man7/capabilities.7:703 msgid "" "Since kernel 2.6.24, the kernel supports associating capability sets with an " "executable file using B(8). The file capability sets are stored in " "an extended attribute (see B(2)) named I. " "Writing to this extended attribute requires the B capability. " "The file capability sets, in conjunction with the capability sets of the " "thread, determine the capabilities of a thread after an B(2)." msgstr "" "カーネル 2.6.24 以降では、 B(8) を使って実行ファイルにケーパビリティ" "セットを対応付けることができる。 ファイルケーパビリティセットは I という名前の拡張属性に保存される (B(2) 参照)。この拡張" "属性への書き込みには B ケーパビリティが必要である。 ファイルケー" "パビリティセットとスレッドのケーパビリティセットの両方が 考慮され、 B" "(2) 後のスレッドのケーパビリティセットが決定される。" #. type: Plain text #: build/C/man7/capabilities.7:705 msgid "The three file capability sets are:" msgstr "3 つのファイルケーパビリティセットが定義されている。" #. type: TP #: build/C/man7/capabilities.7:705 #, no-wrap msgid "I (formerly known as I):" msgstr "I<許可 (Permitted)> (以前のI<強制 (Forced)>):" #. type: Plain text #: build/C/man7/capabilities.7:709 msgid "" "These capabilities are automatically permitted to the thread, regardless of " "the thread's inheritable capabilities." msgstr "" "スレッドの継承可能ケーパビリティに関わらず、そのスレッドに自動的に 認められる" "ケーパビリティ。" #. type: TP #: build/C/man7/capabilities.7:709 #, no-wrap msgid "I (formerly known as I):" msgstr "I<継承可能 (Inheritable)> (以前の I<許容 (Allowed)>):" #. type: Plain text #: build/C/man7/capabilities.7:715 msgid "" "This set is ANDed with the thread's inheritable set to determine which " "inheritable capabilities are enabled in the permitted set of the thread " "after the B(2)." msgstr "" "このセットと、スレッドの継承可能ケーパビリティセットとの 論理積 (AND) がとら" "れ、 B(2) の後にそのスレッドの許可ケーパビリティセットで有効となる " "継承可能ケーパビリティが決定される。" #. type: Plain text #: build/C/man7/capabilities.7:725 msgid "" "This is not a set, but rather just a single bit. If this bit is set, then " "during an B(2) all of the new permitted capabilities for the thread " "are also raised in the effective set. If this bit is not set, then after an " "B(2), none of the new permitted capabilities is in the new effective " "set." msgstr "" "これは集合ではなく、1 ビットの情報である。 このビットがセットされていると、 " "B(2) 実行中に、そのスレッドの新しい許可ケーパビリティが全て 実効ケー" "パビリティ集合においてもセットされる。 このビットがセットされていない場合、 " "B(2) 後には新しい許可ケーパビリティのどれも新しい実効ケーパビリティ" "集合 にセットされない。" #. type: Plain text #: build/C/man7/capabilities.7:741 msgid "" "Enabling the file effective capability bit implies that any file permitted " "or inheritable capability that causes a thread to acquire the corresponding " "permitted capability during an B(2) (see the transformation rules " "described below) will also acquire that capability in its effective set. " "Therefore, when assigning capabilities to a file (B(8), " "B(3), B(3)), if we specify the effective flag as " "being enabled for any capability, then the effective flag must also be " "specified as enabled for all other capabilities for which the corresponding " "permitted or inheritable flags is enabled." msgstr "" "ファイルの実効ケーパビリティビットを有効にするというのは、 B(2) 実行" "時に、ファイルの許可ケーパビリティと継承ケーパビリティに対応するものが スレッ" "ドの許可ケーパビリティセットとしてセットされるが、 これが実効ケーパビリティ" "セットにもセットされるということである (ケーパビリティの変換ルールは下記参" "照)。 したがって、ファイルにケーパビリティを割り当てる際 (B(8), " "B(3), B(3))、 いずれかのケーパビリティに対して実効" "フラグを有効と指定する場合、 許可フラグや継承可能フラグを有効にした他の全ての" "ケーパビリティ についても実効フラグを有効と指定しなければならない。" #. type: SS #: build/C/man7/capabilities.7:741 #, no-wrap msgid "Transformation of capabilities during execve()" msgstr "execve() 中のケーパビリティの変換" #. type: Plain text #: build/C/man7/capabilities.7:747 msgid "" "During an B(2), the kernel calculates the new capabilities of the " "process using the following algorithm:" msgstr "" "B(2) 実行時に、カーネルはプロセスの新しいケーパビリティを次の アルゴ" "リズムを用いて計算する：" #. type: Plain text #: build/C/man7/capabilities.7:752 #, no-wrap msgid "" "P'(permitted) = (P(inheritable) & F(inheritable)) |\n" " (F(permitted) & cap_bset)\n" msgstr "" "P'(permitted) = (P(inheritable) & F(inheritable)) |\n" " (F(permitted) & cap_bset)\n" #. type: Plain text #: build/C/man7/capabilities.7:754 #, no-wrap msgid "P'(effective) = F(effective) ? P'(permitted) : 0\n" msgstr "P'(effective) = F(effective) ? P'(permitted) : 0\n" #. type: Plain text #: build/C/man7/capabilities.7:756 #, no-wrap msgid "P'(inheritable) = P(inheritable) [i.e., unchanged]\n" msgstr "P'(inheritable) = P(inheritable) [つまり、変更されない]\n" #. type: Plain text #: build/C/man7/capabilities.7:760 msgid "where:" msgstr "各変数の意味は以下の通り:" #. type: IP #: build/C/man7/capabilities.7:761 #, no-wrap msgid "P" msgstr "P" #. type: Plain text #: build/C/man7/capabilities.7:764 msgid "denotes the value of a thread capability set before the B(2)" msgstr "B(2) 前のスレッドのケーパビリティセットの値" #. type: IP #: build/C/man7/capabilities.7:764 #, no-wrap msgid "P'" msgstr "P'" #. type: Plain text #: build/C/man7/capabilities.7:767 msgid "denotes the value of a capability set after the B(2)" msgstr "B(2) 後のスレッドのケーパビリティセットの値" #. type: IP #: build/C/man7/capabilities.7:767 #, no-wrap msgid "F" msgstr "F" #. type: Plain text #: build/C/man7/capabilities.7:769 msgid "denotes a file capability set" msgstr "ファイルケーパビリティセットの値" #. type: IP #: build/C/man7/capabilities.7:769 #, no-wrap msgid "cap_bset" msgstr "cap_bset" #. type: Plain text #: build/C/man7/capabilities.7:771 msgid "is the value of the capability bounding set (described below)." msgstr "ケーパビリティバウンディングセットの値 (下記参照)" #. type: SS #: build/C/man7/capabilities.7:773 #, no-wrap msgid "Capabilities and execution of programs by root" msgstr "ケーパビリティと、ルートによるプログラムの実行" #. type: Plain text #: build/C/man7/capabilities.7:778 msgid "" "In order to provide an all-powerful I using capability sets, during an " "B(2):" msgstr "" "B(2) 時に、ケーパビリティセットを使って、全ての権限を持った I " "を実現するには、以下のようにする。" #. type: Plain text #: build/C/man7/capabilities.7:783 msgid "" "If a set-user-ID-root program is being executed, or the real user ID of the " "process is 0 (root) then the file inheritable and permitted sets are " "defined to be all ones (i.e., all capabilities enabled)." msgstr "" "set-user-ID-root プログラムが実行される場合、 またはプロセスの実ユーザ ID が " "0 (root) の場合、 ファイルの継承可能セットと許可セットを全て 1 (全てのケーパ" "ビリティが有効) に定義する。" #. type: Plain text #: build/C/man7/capabilities.7:786 msgid "" "If a set-user-ID-root program is being executed, then the file effective bit " "is defined to be one (enabled)." msgstr "" "set-user-ID-root プログラムが実行される場合、 ファイルの実効ケーパビリティ" "ビットを 1 (enabled) に定義する。" #. If a process with real UID 0, and nonzero effective UID does an #. exec(), then it gets all capabilities in its #. permitted set, and no effective capabilities #. type: Plain text #: build/C/man7/capabilities.7:801 msgid "" "The upshot of the above rules, combined with the capabilities " "transformations described above, is that when a process B(2)s a set-" "user-ID-root program, or when a process with an effective UID of 0 B" "(2)s a program, it gains all capabilities in its permitted and effective " "capability sets, except those masked out by the capability bounding set. " "This provides semantics that are the same as those provided by traditional " "UNIX systems." msgstr "" "上記のルールにケーパビリティ変換を適用した結果をまとめると、 プロセスが set-" "user-ID-root プログラムを B(2) する場合、または実効 UID が 0 のプロ" "セスがプログラムを B(2) する場合、許可と実効のケーパビリティセットの" "全ケーパビリティ (正確には、ケーパビリティバウンディングセットによるマスクで" "除外されるもの 以外の全てのケーパビリティ) を取得するということである。 これ" "により、伝統的な UNIX システムと同じ振る舞いができるようになっている。" #. type: SS #: build/C/man7/capabilities.7:801 #, no-wrap msgid "Capability bounding set" msgstr "ケーパビリティ・バウンディングセット" #. type: Plain text #: build/C/man7/capabilities.7:806 msgid "" "The capability bounding set is a security mechanism that can be used to " "limit the capabilities that can be gained during an B(2). The " "bounding set is used in the following ways:" msgstr "" "ケーパビリティ・バウンディングセット (capability bounding set) は、 B" "(2) 時に獲得できるケーパビリティを制限するために使われる セキュリティ機構で" "ある。 バウンディングセットは以下のように使用される。" #. type: Plain text #: build/C/man7/capabilities.7:814 msgid "" "During an B(2), the capability bounding set is ANDed with the file " "permitted capability set, and the result of this operation is assigned to " "the thread's permitted capability set. The capability bounding set thus " "places a limit on the permitted capabilities that may be granted by an " "executable file." msgstr "" "B(2) 実行時に、ケーパビリティ・バウンディングセットと ファイルの許可" "ケーパビリティセットの論理和 (AND) を取ったものが、 そのスレッドの許可ケーパ" "ビリティセットに割り当てられる。 つまり、ケーパビリティ・バウンディングセット" "は、 実行ファイルが認めている許可ケーパビリティに対して 制限を課す働きをす" "る。" #. type: Plain text #: build/C/man7/capabilities.7:826 msgid "" "(Since Linux 2.6.25) The capability bounding set acts as a limiting " "superset for the capabilities that a thread can add to its inheritable set " "using B(2). This means that if a capability is not in the bounding " "set, then a thread can't add this capability to its inheritable set, even if " "it was in its permitted capabilities, and thereby cannot have this " "capability preserved in its permitted set when it B(2)s a file that " "has the capability in its inheritable set." msgstr "" "(Linux 2.6.25 以降) ケーパビリティ・バウンディングセットは、スレッドが " "B(2) により自身の継承可能セットに追加可能なケーパビリティの母集団を " "制限する役割を持つ。 スレッドに許可されたケーパビリティであっても、バウンディ" "ングセットに 含まれていなければ、スレッドはそのケーパビリティは自身の継承可能" "セットに 追加できず、その結果、継承可能セットにそのケーパビリティを含むファイ" "ルを B(2) する場合、そのケーパビリティを許可セットに持ち続けることが" "できない、 ということである。" #. type: Plain text #: build/C/man7/capabilities.7:833 msgid "" "Note that the bounding set masks the file permitted capabilities, but not " "the inherited capabilities. If a thread maintains a capability in its " "inherited set that is not in its bounding set, then it can still gain that " "capability in its permitted set by executing a file that has the capability " "in its inherited set." msgstr "" "バウンディングセットがマスクを行うのは、継承可能ケーパビリティではなく、 ファ" "イルの許可ケーパビリティのマスクを行う点に注意すること。 あるスレッドの継承可" "能セットにそのスレッドのバウンディングセットに 存在しないケーパビリティが含ま" "れている場合、そのスレッドは、 継承可能セットに含まれるケーパビリティを持つ" "ファイルを実行することにより、 許可セットに含まれるケーパビリティも獲得できる" "ということである。" #. type: Plain text #: build/C/man7/capabilities.7:836 msgid "" "Depending on the kernel version, the capability bounding set is either a " "system-wide attribute, or a per-process attribute." msgstr "" "カーネルのバージョンにより、ケーパビリティ・バウンディングセットは システム共" "通の属性の場合と、プロセス単位の属性の場合がある。" #. type: Plain text #: build/C/man7/capabilities.7:838 msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:846 msgid "" "In kernels before 2.6.25, the capability bounding set is a system-wide " "attribute that affects all threads on the system. The bounding set is " "accessible via the file I. (Confusingly, this " "bit mask parameter is expressed as a signed decimal number in I.)" msgstr "" "2.6.25 より前のカーネルでは、ケーパビリティ・バウンディングセットは システム" "共通の属性で、システム上の全てのスレッドに適用される。 バウンディングセット" "は I ファイル経由で参照できる。 (間違えやすいが、" "このビットマスク形式のパラメータは、 I では符号付" "きの十進数で表現される。)" #. type: Plain text #: build/C/man7/capabilities.7:853 msgid "" "Only the B process may set capabilities in the capability bounding " "set; other than that, the superuser (more precisely: programs with the " "B capability) may only clear capabilities from this set." msgstr "" "B プロセスだけがケーパビリティ・バウンディングセットで ケーパビリティを" "セットすることができる。 それ以外では、スーパーユーザ (より正確には、 " "B ケーパビリティを持ったプログラム) が、 ケーパビリティ・バウ" "ンディングセットのケーパビリティのクリアが できるだけである。" #. type: Plain text #: build/C/man7/capabilities.7:862 msgid "" "On a standard system the capability bounding set always masks out the " "B capability. To remove this restriction (dangerous!), modify " "the definition of B in I and " "rebuild the kernel." msgstr "" "通常のシステムでは、ケーパビリティ・バウンディングセットは、 B " "が無効になっている。 この制限を取り去るには (取り去るのは危険!)、 I 内の B の定義を修正し、カーネルを再構築" "する必要がある。" #. type: Plain text #: build/C/man7/capabilities.7:866 msgid "" "The system-wide capability bounding set feature was added to Linux starting " "with kernel version 2.2.11." msgstr "" "システム共通のケーパビリティ・バウンディングセット機能は、 カーネル 2.2.11 以" "降で Linux に追加された。" #. type: Plain text #: build/C/man7/capabilities.7:868 msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:873 msgid "" "From Linux 2.6.25, the I is a per-thread " "attribute. (There is no longer a system-wide capability bounding set.)" msgstr "" "Linux 2.6.25 以降では、 「ケーパビリティ・バウンディングセット」はスレッド単" "位の属性である (システム共通のケーパビリティ・バウンディングセットはもはや存" "在しない)。" #. type: Plain text #: build/C/man7/capabilities.7:878 msgid "" "The bounding set is inherited at B(2) from the thread's parent, and " "is preserved across an B(2)." msgstr "" "バウンディングセットは B(2) 時にはスレッドの親プロセスから継承され、 " "B(2) の前後では保持される。" #. type: Plain text #: build/C/man7/capabilities.7:891 msgid "" "A thread may remove capabilities from its capability bounding set using the " "B(2) B operation, provided it has the " "B capability. Once a capability has been dropped from the " "bounding set, it cannot be restored to that set. A thread can determine if " "a capability is in its bounding set using the B(2) " "B operation." msgstr "" "スレッドが B ケーパビリティを持っている場合、そのスレッドは " "B(2) の B 操作を使って自身のケーパビリティ・バウン" "ディングセットから ケーパビリティを削除することができる。 いったんケーパビリ" "ティをバウンディングセットから削除してしまうと、 スレッドはそのケーパビリティ" "を再度セットすることはできない。 B(2) の B 操作を使" "うことで、スレッドがあるケーパビリティが自身のバウンディングセット に含まれて" "いるかを知ることができる。" #. type: Plain text #: build/C/man7/capabilities.7:909 msgid "" "Removing capabilities from the bounding set is supported only if file " "capabilities are compiled into the kernel. In kernels before Linux 2.6.33, " "file capabilities were an optional feature configurable via the " "CONFIG_SECURITY_FILE_CAPABILITIES option. Since Linux 2.6.33, the " "configuration option has been removed and file capabilities are always part " "of the kernel. When file capabilities are compiled into the kernel, the " "B process (the ancestor of all processes) begins with a full bounding " "set. If file capabilities are not compiled into the kernel, then B " "begins with a full bounding set minus B, because this " "capability has a different meaning when there are no file capabilities." msgstr "" "バウンディングセットからのケーパビリティの削除がサポートされるのは、\n" "カーネルのコンパイル時にファイルケーパビリティが有効になっている場合\n" "だけである。Linux 2.6.33 より前のカーネルでは、ファイルケーパビリティは\n" "設定オプション CONFIG_SECURITY_FILE_CAPABILITIES で切り替えられる追加の\n" "機能であった。Linux 2.6.33 以降では、この設定オプションは削除され、\n" "ファイルケーパビリティは常にカーネルに組込まれるようになった。\n" "ファイルケーパビリティがカーネルにコンパイル時に組み込まれている場合、\n" "(全てのプロセスの先祖である) I プロセスはバウンディングセットで\n" "全てのケーパビリティが セットされた状態で開始する。ファイルケーパビリティ\n" "が有効になっていない場合には、 I はバウンディングセットで\n" "B 以外の全てのケーパビリティがセットされた状態で開始する。\n" "このようになっているのは、 B ケーパビリティがファイルケー\n" "パビリティがサポートされていない場合には 違った意味を持つからである。" #. type: Plain text #: build/C/man7/capabilities.7:916 msgid "" "Removing a capability from the bounding set does not remove it from the " "thread's inherited set. However it does prevent the capability from being " "added back into the thread's inherited set in the future." msgstr "" "バウンディングセットからケーパビリティを削除しても、 スレッドの継承可能セット" "からはそのケーパビリティは削除されない。 しかしながら、バウンディングセットか" "らの削除により、 この先そのケーパビリティをスレッドの継承可能セットに追加する" "こと はできなくなる。" #. type: SS #: build/C/man7/capabilities.7:916 #, no-wrap msgid "Effect of user ID changes on capabilities" msgstr "ユーザ ID 変更のケーパビリティへの影響" #. type: Plain text #: build/C/man7/capabilities.7:925 msgid "" "To preserve the traditional semantics for transitions between 0 and nonzero " "user IDs, the kernel makes the following changes to a thread's capability " "sets on changes to the thread's real, effective, saved set, and filesystem " "user IDs (using B(2), B(2), or similar):" msgstr "" "ユーザ ID が 0 と 0 以外の間で変化する際の振る舞いを従来と同じにするため、 ス" "レッドの実 UID、実効 UID、保存 set-user-ID、ファイルシステム UID が " "(B(2), B(2) などを使って) 変更された際に、カーネルはその" "スレッドのケーパビリティセットに 以下の変更を行う:" #. type: Plain text #: build/C/man7/capabilities.7:931 msgid "" "If one or more of the real, effective or saved set user IDs was previously " "0, and as a result of the UID changes all of these IDs have a nonzero value, " "then all capabilities are cleared from the permitted and effective " "capability sets." msgstr "" "UID の変更前には実 UID、実効 UID、保存 set-user-ID のうち 少なくとも一つが 0 " "で、変更後に実 UID、実効 UID、保存 set-user-ID が すべて 0 以外の値になった場" "合、許可と実効のケーパビリティセットの 全ケーパビリティをクリアする。" #. type: Plain text #: build/C/man7/capabilities.7:934 msgid "" "If the effective user ID is changed from 0 to nonzero, then all capabilities " "are cleared from the effective set." msgstr "" "実効 UID が 0 から 0 以外に変更された場合、 実効ケーパビリティセットの全ケー" "パビリティをクリアする。" #. type: Plain text #: build/C/man7/capabilities.7:937 msgid "" "If the effective user ID is changed from nonzero to 0, then the permitted " "set is copied to the effective set." msgstr "" "実効 UID が 0 以外から 0 に変更された場合、 許可ケーパビリティセットの内容を" "実効ケーパビリティセットにコピーする。" #. type: IP #: build/C/man7/capabilities.7:937 build/C/man7/capabilities.7:992 #, no-wrap msgid "4." msgstr "4." #. type: Plain text #: build/C/man7/capabilities.7:955 #, fuzzy #| msgid "" #| "If the filesystem user ID is changed from 0 to nonzero (see B" #| "(2)) then the following capabilities are cleared from the effective set: " #| "B, B, B, B, " #| "B, B (since Linux 2.6.30), " #| "B, and B (since Linux 2.6.30). If the " #| "filesystem UID is changed from nonzero to 0, then any of these " #| "capabilities that are enabled in the permitted set are enabled in the " #| "effective set." msgid "" "If the filesystem user ID is changed from 0 to nonzero (see B(2)), " "then the following capabilities are cleared from the effective set: " "B, B, B, B, " "B, B (since Linux 2.6.30), " "B, and B (since Linux 2.6.30). If the " "filesystem UID is changed from nonzero to 0, then any of these capabilities " "that are enabled in the permitted set are enabled in the effective set." msgstr "" "ファイルシステム UID が 0 から 0 以外に変更された場合 (B(2) 参" "照)、実効ケーパビリティセットの以下のケーパビリティがクリアされる: " "B, B, B, B, " "B, B (Linux 2.6.30 以降), " "B, B (Linux 2.6.30 以降)。 ファイルシステム UID " "が 0 以外から 0 に変更された場合、 上記のケーパビリティのうち許可ケーパビリ" "ティセットで有効になっているものが 実効ケーパビリティセットで有効にされる。" #. type: Plain text #: build/C/man7/capabilities.7:963 msgid "" "If a thread that has a 0 value for one or more of its user IDs wants to " "prevent its permitted capability set being cleared when it resets all of its " "user IDs to nonzero values, it can do so using the B(2) " "B operation." msgstr "" "各種 UID のうち少なくとも一つが 0 であるスレッドが、 その UID の全てが 0 以外" "になったときに許可ケーパビリティセットが クリアされないようにしたい場合に" "は、 B(2) の B 操作を使えばよい。" #. type: SS #: build/C/man7/capabilities.7:963 #, no-wrap msgid "Programmatically adjusting capability sets" msgstr "プログラムでケーパビリティセットを調整する" #. type: Plain text #: build/C/man7/capabilities.7:978 msgid "" "A thread can retrieve and change its capability sets using the B(2) " "and B(2) system calls. However, the use of B(3) and " "B(3), both provided in the I package, is preferred for " "this purpose. The following rules govern changes to the thread capability " "sets:" msgstr "" "各スレッドは、 B(2) や B(2) を使って、自身のケーパビリティ" "セットを取得したり変更したりできる。 ただし、これを行うには、 I パッ" "ケージで提供されている B(3) や B(3) を使うのが" "望ましい。 スレッドのケーパビリティセットの変更には以下のルールが適用される。" #. type: Plain text #: build/C/man7/capabilities.7:984 msgid "" "If the caller does not have the B capability, the new " "inheritable set must be a subset of the combination of the existing " "inheritable and permitted sets." msgstr "" "呼び出し側が B ケーパビリティを持っていない場合、新しい継承可能" "セットは、 既存の継承可能セットと許可セットの積集合 (AND) の部分集合で なけれ" "ばならない。" #. type: Plain text #: build/C/man7/capabilities.7:988 msgid "" "(Since Linux 2.6.25) The new inheritable set must be a subset of the " "combination of the existing inheritable set and the capability bounding set." msgstr "" "(Linux 2.6.25 以降) 新しい継承可能セットは、既存の継承可能セットとケーパビリ" "ティ・ バウンディングセットの積集合 (AND) の部分集合でなければならない。" #. type: Plain text #: build/C/man7/capabilities.7:992 msgid "" "The new permitted set must be a subset of the existing permitted set (i.e., " "it is not possible to acquire permitted capabilities that the thread does " "not currently have)." msgstr "" "新しい許可セットは、既存の許可セットの部分集合でなければならない (つまり、そ" "のスレッドが現在持っていない許可ケーパビリティを 獲得することはできない)。" #. type: Plain text #: build/C/man7/capabilities.7:994 msgid "The new effective set must be a subset of the new permitted set." msgstr "" "新しい実効ケーパビリティセットは新しい許可ケーパビリティセットの 部分集合に" "なっていなければならない。" #. type: SS #: build/C/man7/capabilities.7:994 #, no-wrap msgid "The securebits flags: establishing a capabilities-only environment" msgstr "securebits フラグ: ケーパビリティだけの環境を構築する" #. For some background: #. see http://lwn.net/Articles/280279/ and #. http://article.gmane.org/gmane.linux.kernel.lsm/5476/ #. type: Plain text #: build/C/man7/capabilities.7:1005 msgid "" "Starting with kernel 2.6.26, and with a kernel in which file capabilities " "are enabled, Linux implements a set of per-thread I flags that " "can be used to disable special handling of capabilities for UID 0 " "(I). These flags are as follows:" msgstr "" "カーネル 2.6.26 以降で、 ファイルケーパビリティが有効になったカーネルでは、 " "スレッド単位の I フラグが実装されており、このフラグを使うと UID " "0 (I) に対するケーパビリティの特別扱いを無効することができる。 以下の" "ようなフラグがある。" #. type: TP #: build/C/man7/capabilities.7:1005 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:1017 msgid "" "Setting this flag allows a thread that has one or more 0 UIDs to retain its " "capabilities when it switches all of its UIDs to a nonzero value. If this " "flag is not set, then such a UID switch causes the thread to lose all " "capabilities. This flag is always cleared on an B(2). (This flag " "provides the same functionality as the older B(2) B " "operation.)" msgstr "" "このフラグをセットされている場合、UID が 0 のスレッドの UID が 0 以外の値に " "切り替わる際に、そのスレッドはケーパビリティを維持することができる。 このフラ" "グがセットされていない場合には、UID が 0 から 0 以外の値に 切り替わると、その" "スレッドは全てのケーパビリティを失う。 このフラグは B(2) 時には全て" "クリアされる (このフラグは、以前の B(2) の B 操作と" "同じ機能を提供するものである)。" #. type: TP #: build/C/man7/capabilities.7:1017 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:1024 msgid "" "Setting this flag stops the kernel from adjusting capability sets when the " "threads's effective and filesystem UIDs are switched between zero and " "nonzero values. (See the subsection I.)" msgstr "" "このフラグをセットすると、スレッドの実効 UID とファイルシステム UID が 0 と " "0 以外の間で切り替わった場合に、 カーネルはケーパビリティセットの調整を行わな" "くなる (「ユーザ ID 変更のケーパビリティへの影響」の節を参照)。" #. type: TP #: build/C/man7/capabilities.7:1024 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man7/capabilities.7:1032 msgid "" "If this bit is set, then the kernel does not grant capabilities when a set-" "user-ID-root program is executed, or when a process with an effective or " "real UID of 0 calls B(2). (See the subsection I.)" msgstr "" "このビットがセットされている場合、 set-user-ID-root プログラムの実行時や、 実" "効 UID か 実 UID が 0 のプロセスが B(2) を呼び出した時に、カーネルは" "ケーパビリティを許可しない (「ケーパビリティと、ルートによるプログラムの実" "行」の節を参照)。" #. type: Plain text #: build/C/man7/capabilities.7:1042 msgid "" "Each of the above \"base\" flags has a companion \"locked\" flag. Setting " "any of the \"locked\" flags is irreversible, and has the effect of " "preventing further changes to the corresponding \"base\" flag. The locked " "flags are: B, B, and " "B." msgstr "" "上記の \"base\" フラグの各々には対応する \"locked\" フラグが存在する。 いずれ" "の \"locked\" フラグも一度セットされると戻すことはできず、 それ以降は対応す" "る \"base\" フラグを変更することができなくなる。 \"locked\" フラグは " "B, B, " "B という名前である。" #. type: Plain text #: build/C/man7/capabilities.7:1054 msgid "" "The I flags can be modified and retrieved using the B(2) " "B and B operations. The " "B capability is required to modify the flags." msgstr "" "I フラグは、 B(2) の操作 B や " "B を使うことで変更したり取得したりできる。 フラグを変更す" "るには B ケーパビリティが必要である。" #. type: Plain text #: build/C/man7/capabilities.7:1063 msgid "" "The I flags are inherited by child processes. During an " "B(2), all of the flags are preserved, except B " "which is always cleared." msgstr "" "I フラグは子プロセスに継承される。 B(2) においては、\n" "B が常にクリアされる以外は、全てのフラグが保持される。" #. type: Plain text #: build/C/man7/capabilities.7:1068 msgid "" "An application can use the following call to lock itself, and all of its " "descendants, into an environment where the only way of gaining capabilities " "is by executing a program with associated file capabilities:" msgstr "" "アプリケーションは、以下の呼び出しを行うことにより、 自分自身および子孫となる" "プロセス全てに対して、 必要なファイルケーパビリティを持ったプログラムを実行し" "ない限り、 対応するケーパビリティを獲得できないような状況に閉じこめることがで" "きる。" #. type: Plain text #: build/C/man7/capabilities.7:1077 #, no-wrap msgid "" "prctl(PR_SET_SECUREBITS,\n" " SECBIT_KEEP_CAPS_LOCKED |\n" " SECBIT_NO_SETUID_FIXUP |\n" " SECBIT_NO_SETUID_FIXUP_LOCKED |\n" " SECBIT_NOROOT |\n" " SECBIT_NOROOT_LOCKED);\n" msgstr "" "prctl(PR_SET_SECUREBITS,\n" " SECBIT_KEEP_CAPS_LOCKED |\n" " SECBIT_NO_SETUID_FIXUP |\n" " SECBIT_NO_SETUID_FIXUP_LOCKED |\n" " SECBIT_NOROOT |\n" " SECBIT_NOROOT_LOCKED);\n" #. type: Plain text #: build/C/man7/capabilities.7:1085 msgid "" "No standards govern capabilities, but the Linux capability implementation is " "based on the withdrawn POSIX.1e draft standard; see E<.UR http://wt." "tuxomania.net\\:/publications\\:/posix.1e/> E<.UE .>" msgstr "" "ケーパビリティに関する標準はないが、 Linux のケーパビリティは廃案になった " "POSIX.1e 草案に基づいて実装されている。 E<.UR http://wt.xpilot.org\\:/" "publications\\:/posix.1e/> E<.UE> を参照。" #. type: Plain text #: build/C/man7/capabilities.7:1089 msgid "" "Since kernel 2.5.27, capabilities are an optional kernel component, and can " "be enabled/disabled via the CONFIG_SECURITY_CAPABILITIES kernel " "configuration option." msgstr "" "カーネル 2.5.27 以降、ケーパビリティは選択式のカーネルコンポーネント となって" "おり、カーネル設定オプション CONFIG_SECURITY_CAPABILITIES により有効/無効を切" "り替えることができる。" #. 7b9a7ec565505699f503b4fcf61500dceb36e744 #. type: Plain text #: build/C/man7/capabilities.7:1103 msgid "" "The I file can be used to view the capability " "sets of a thread. The I file shows the capability sets of " "a process's main thread. Before Linux 3.8, nonexistent capabilities were " "shown as being enabled (1) in these sets. Since Linux 3.8, all nonexistent " "capabilities (above B) are shown as disabled (0)." msgstr "" "I ファイルを使うと、スレッドのケーパビリティセット" "を見ることができる。 I ファイルには、プロセスのメインスレッ" "ドのケーパビリティセットが表示される。 Linux 3.8 より前では、 これらのケーパ" "ビリティセットの表示で、 存在しないケーパビリティはすべて有効 (1) として表示" "される。 Linux 3.8 以降では、 存在しないケーパビリティはすべて無効 (0) として" "表示される。 (B より大きい値を持つケーパビリティが存在しない" "ケーパビリティである)。" #. type: Plain text #: build/C/man7/capabilities.7:1118 msgid "" "The I package provides a suite of routines for setting and getting " "capabilities that is more comfortable and less likely to change than the " "interface provided by B(2) and B(2). This package also " "provides the B(8) and B(8) programs. It can be found at" msgstr "" "I パッケージは、ケーパビリティを設定・取得するための ルーチン群を提供" "している。これらのインタフェースは、 B(2) と B(2) が提供す" "るインターフェースと比べて、より使いやすく、変更される可能性が少ない。 この" "パッケージでは、 B(8), B(8) というプログラムも提供されてい" "る。 パッケージは以下で入手できる。" #. type: Plain text #: build/C/man7/capabilities.7:1121 msgid "" "E<.UR http://www.kernel.org\\:/pub\\:/linux\\:/libs\\:/security\\:/linux-" "privs> E<.UE .>" msgstr "" "E<.UR http://www.kernel.org\\:/pub\\:/linux\\:/libs\\:/security\\:/linux-" "privs> E<.UE .>" #. type: Plain text #: build/C/man7/capabilities.7:1130 msgid "" "Before kernel 2.6.24, and since kernel 2.6.24 if file capabilities are not " "enabled, a thread with the B capability can manipulate the " "capabilities of threads other than itself. However, this is only " "theoretically possible, since no thread ever has B in either of " "these cases:" msgstr "" "バージョン 2.6.24 より前、およびファイルケーパビリティが 有効になっていない" "2.6.24 以降のカーネルでは、 B ケーパビリティを持ったスレッドは自" "分以外のスレッドの ケーパビリティを操作できる。 しかしながら、これは理論的に" "可能というだけである。 以下のいずれかの場合においても、どのスレッドも " "B ケーパビリティを持つことはないからである。" #. type: Plain text #: build/C/man7/capabilities.7:1135 msgid "" "In the pre-2.6.25 implementation the system-wide capability bounding set, I, always masks out this capability, and this can " "not be changed without modifying the kernel source and rebuilding." msgstr "" "2.6.25 より前の実装では、システム共通のケーパビリティ・バウンディングセット " "I ではこのケーパビリティは常に無効になっており、 " "ソースを変更してカーネルを再コンパイルしない限り、 これを変更することはできな" "い。" #. type: Plain text #: build/C/man7/capabilities.7:1141 msgid "" "If file capabilities are disabled in the current implementation, then " "B starts out with this capability removed from its per-process " "bounding set, and that bounding set is inherited by all other processes " "created on the system." msgstr "" "現在の実装ではファイルケーパビリティが無効になっている場合、 プロセス毎のバウ" "ンディングセットからこのケーパビリティを抜いて B は開始され、 システム" "上で生成される他の全てのプロセスでこのバウンディングセットが 継承される。" #. type: Plain text #: build/C/man7/capabilities.7:1158 msgid "" "B(2), B(2), B(2), B(3), B" "(3), B(3), B(3), B(3), B" "(3), B(3), B(3), B(3), B(7), " "B(7), B(8), B(8)" msgstr "" "B(2), B(2), B(2), B(3),\n" "B(3), B(3), B(3),\n" "B(3), B(3), B(3), B(3),\n" "B(3), B(7), B(7), B(8), B(8)" #. type: Plain text #: build/C/man7/capabilities.7:1161 msgid "I in the Linux kernel source tree" msgstr "Linux カーネルソース内の I" #. type: TH #: build/C/man2/capget.2:15 #, no-wrap msgid "CAPGET" msgstr "CAPGET" #. type: TH #: build/C/man2/capget.2:15 #, no-wrap msgid "2013-03-11" msgstr "2013-03-11" #. type: Plain text #: build/C/man2/capget.2:18 msgid "capget, capset - set/get capabilities of thread(s)" msgstr "capget, capset - スレッドのケーパビリティを設定/取得する" #. type: Plain text #: build/C/man2/capget.2:20 msgid "B<#include Esys/capability.hE>" msgstr "B<#include Esys/capability.hE>" #. type: Plain text #: build/C/man2/capget.2:22 msgid "" "BIB<, cap_user_data_t >IB<);>" msgstr "" "BIB<, cap_user_data_t >IB<);>" #. type: Plain text #: build/C/man2/capget.2:24 msgid "" "BIB<, const cap_user_data_t " ">IB<);>" msgstr "" "BIB<, const cap_user_data_t " ">IB<);>" #. type: Plain text #: build/C/man2/capget.2:35 msgid "" "As of Linux 2.2, the power of the superuser (root) has been partitioned into " "a set of discrete capabilities. Each thread has a set of effective " "capabilities identifying which capabilities (if any) it may currently " "exercise. Each thread also has a set of inheritable capabilities that may " "be passed through an B(2) call, and a set of permitted capabilities " "that it can make effective or inheritable." msgstr "" "Linux 2.2 で、スーパーユーザー (root) の権限は、個別のケーパビリティ " "(capabilities) へと分割され、その集合として表現されるようになった。 各スレッ" "ドは「実効ケーパビリティ (effective capability) の集合」を持ち、 それによって" "現在どの操作が実行可能かを識別できる。 また、各スレッドは、 「継承可能ケーパ" "ビリティ (inheritable capability) の集合」と 「許可ケーパビリティ (permitted " "capability) の集合」を持つ。 「継承可能ケーパビリティの集合」は B" "(2) を通じて渡すことができるケーパビリティの集合であり、 「許可ケーパビリ" "ティ (permitted capability) の集合」は 実効ケーパビリティや継承可能ケーパビリ" "ティとして有効にできる ケーパビリティを規定するものである。" #. type: Plain text #: build/C/man2/capget.2:44 msgid "" "These two system calls are the raw kernel interface for getting and setting " "thread capabilities. Not only are these system calls specific to Linux, but " "the kernel API is likely to change and use of these system calls (in " "particular the format of the I types) is subject to extension " "with each kernel revision, but old programs will keep working." msgstr "" "この二つのシステムコールはスレッドのケーパビリティを取得したり設定したりする" "ための 生のカーネルインターフェースである。 これらのシステムコールは Linux 特" "有であるというだけでなく、 カーネル API は変更されるかもしれず、これらのシス" "テムコールの使用法 (特に I 型という書式) はカーネルのリビジョン" "毎に拡張されるかもしれないが、 以前のプログラムはそのまま動作する。" #. type: Plain text #: build/C/man2/capget.2:55 #, fuzzy #| msgid "" #| "The portable interfaces are B(3) and B(3); " #| "if possible you should use those interfaces in applications. If you wish " #| "to use the Linux extensions in applications, you should use the easier-to-" #| "use interfaces B(3) and B(3)." msgid "" "The portable interfaces are B(3) and B(3); if " "possible, you should use those interfaces in applications. If you wish to " "use the Linux extensions in applications, you should use the easier-to-use " "interfaces B(3) and B(3)." msgstr "" "移植性のあるインターフェースは B(3) と B(3) で" "ある。 可能ならばアプリケーションはこれらの関数を使用すべきである。 アプリ" "ケーションに Linux 拡張を使用したい場合には、より簡単に 使えるインターフェー" "スである B(3) と B(3) を使用すべきである。" #. type: SS #: build/C/man2/capget.2:55 #, no-wrap msgid "Current details" msgstr "現在の詳細" #. type: Plain text #: build/C/man2/capget.2:58 msgid "" "Now that you have been warned, some current kernel details. The structures " "are defined as follows." msgstr "" "現在のカーネルの詳細について注意を述べておく。 構造体は以下のように定義され" "る。" #. type: Plain text #: build/C/man2/capget.2:63 #, no-wrap msgid "" "#define _LINUX_CAPABILITY_VERSION_1 0x19980330\n" "#define _LINUX_CAPABILITY_U32S_1 1\n" msgstr "" "#define _LINUX_CAPABILITY_VERSION_1 0x19980330\n" "#define _LINUX_CAPABILITY_U32S_1 1\n" #. type: Plain text #: build/C/man2/capget.2:66 #, no-wrap msgid "" "#define _LINUX_CAPABILITY_VERSION_2 0x20071026\n" "#define _LINUX_CAPABILITY_U32S_2 2\n" msgstr "" "#define _LINUX_CAPABILITY_VERSION_2 0x20071026\n" "#define _LINUX_CAPABILITY_U32S_2 2\n" #. type: Plain text #: build/C/man2/capget.2:71 #, no-wrap msgid "" "typedef struct __user_cap_header_struct {\n" " __u32 version;\n" " int pid;\n" "} *cap_user_header_t;\n" msgstr "" "typedef struct __user_cap_header_struct {\n" " __u32 version;\n" " int pid;\n" "} *cap_user_header_t;\n" #. type: Plain text #: build/C/man2/capget.2:77 #, no-wrap msgid "" "typedef struct __user_cap_data_struct {\n" " __u32 effective;\n" " __u32 permitted;\n" " __u32 inheritable;\n" "} *cap_user_data_t;\n" msgstr "" "typedef struct __user_cap_data_struct {\n" " __u32 effective;\n" " __u32 permitted;\n" " __u32 inheritable;\n" "} *cap_user_data_t;\n" #. type: Plain text #: build/C/man2/capget.2:96 msgid "" "The I, I, and I fields are bit masks of " "the capabilities defined in B(7). Note the B values " "are bit indexes and need to be bit-shifted before ORing into the bit " "fields. To define the structures for passing to the system call you have to " "use the I and I names because the typedefs are only pointers." msgstr "" "フィールド I, I, I は、 B" "(7) で定義されるケーパビリティのビットマスクである。 I はビット番号を" "表すインデックス値であり、 ビットフィールドに OR を行う前に I の値の分" "だけビットシフトを行う必要がある。 typedef の方はポインタなので、 このシステ" "ムコールに渡す構造体を定義するには、 I と " "I という名前を使用しなければならない。" #. type: Plain text #: build/C/man2/capget.2:108 msgid "" "Kernels prior to 2.6.25 prefer 32-bit capabilities with version " "B<_LINUX_CAPABILITY_VERSION_1>, and kernels 2.6.25+ prefer 64-bit " "capabilities with version B<_LINUX_CAPABILITY_VERSION_2>. Note, 64-bit " "capabilities use I[0] and I[1], whereas 32-bit capabilities " "use only I[0]." msgstr "" "カーネル 2.6.25 より前では、バージョン B<_LINUX_CAPABILITY_VERSION_1> の 32 " "ビットケーパビリティが推奨である。 カーネル 2.6.25 以降では、バージョン " "B<_LINUX_CAPABILITY_VERSION_2> の 64 ビットケーパビリティが推奨である。 64 " "ビットケーパビリティでは I[0] と I[1] が使用されるのに対し、 " "32 ビットケーパビリティでは I[0] だけが使用される。" #. type: Plain text #: build/C/man2/capget.2:112 msgid "" "Another change affecting the behavior of these system calls is kernel " "support for file capabilities (VFS capability support). This support is " "currently a compile time option (added in kernel 2.6.24)." msgstr "" "これらのシステムコールの挙動に影響があるもう一つの変更点は、 ファイルケーパビ" "リティ (file capabilities) のカーネルによるサポート (VFS ケーパビリティのサ" "ポート) である。 VFS ケーパビリティのサポートは現在のところコンパイル時のオプ" "ションである (カーネル 2.6.24 で追加された)。" #. type: Plain text #: build/C/man2/capget.2:119 msgid "" "For B() calls, one can probe the capabilities of any process by " "specifying its process ID with the Ipid> field value." msgstr "" "B() では、 Ipid> のフィールド値にケーパビリティを知りたい" "プロセスのプロセス ID を 指定することで、任意のプロセスのケーパビリティを調べ" "ることができる。" #. type: SS #: build/C/man2/capget.2:119 #, no-wrap msgid "With VFS capability support" msgstr "VFS ケーパビリティがサポートされている場合" #. type: Plain text #: build/C/man2/capget.2:131 msgid "" "VFS Capability support creates a file-attribute method for adding " "capabilities to privileged executables. This privilege model obsoletes " "kernel support for one process asynchronously setting the capabilities of " "another. That is, with VFS support, for B() calls the only " "permitted values for Ipid> are 0 or B(2), which are " "equivalent." msgstr "" "VFS ケーパビリティのサポートでは、特権実行ファイルにケーパビリティを 追加する" "ためのファイル属性メソッドが作成された。 この特権モデルの導入により、あるプロ" "セスにより別のプロセスのケーパビリティ を非同期に設定する機能のカーネルによる" "サポートは廃止される。 つまり、VFS サポートでは、 B() を呼び出す際" "に Ipid> の値として許されるのは 0 と B(2) が返す値だけと" "なる (どちらの値でも等価である)。" #. type: SS #: build/C/man2/capget.2:131 #, no-wrap msgid "Without VFS capability support" msgstr "VFS ケーパビリティがサポートされていない場合" #. type: Plain text #: build/C/man2/capget.2:157 msgid "" "When the kernel does not support VFS capabilities, B() calls can " "operate on the capabilities of the thread specified by the I field of " "I when that is nonzero, or on the capabilities of the calling thread " "if I is 0. If I refers to a single-threaded process, then I " "can be specified as a traditional process ID; operating on a thread of a " "multithreaded process requires a thread ID of the type returned by B" "(2). For B(), I can also be: -1, meaning perform the change on " "all threads except the caller and B(8); or a value less than -1, in " "which case the change is applied to all members of the process group whose " "ID is -I." msgstr "" "カーネルが VFS ケーパビリティをサポートしていない場合、 I の I " "フィールドが 0 以外であれば、 B() の操作対象は I で指定されたス" "レッドのケーパビリティになる。 I が 0 の場合は呼び出し元のスレッドのケー" "パビリティが操作対象となる。 I がシングルスレッド・プロセスを参照してい" "る場合、 I は以前から使われているプロセスID を使って指定できる。 マルチ" "スレッド・プロセス内のあるスレッドを対象にする場合は、 B(2) が返すス" "レッドID を用いて指定する必要がある。 また、 B() では -1 や -1 より" "小さな値を指定することもできる。 -1 は呼び出し元と B(8) を除く全てのス" "レッドを対象として変更を行うことを、 -1 より小さな値は ID が -I のプロセ" "スグループの全メンバ を対象として変更を行うことを意味する。" #. type: Plain text #: build/C/man2/capget.2:160 msgid "For details on the data, see B(7)." msgstr "このデータの詳細は B(7) を参照すること。" #. type: Plain text #: build/C/man2/capget.2:179 msgid "" "The calls will fail with the error B, and set the I field " "of I to the kernel preferred value of B<_LINUX_CAPABILITY_VERSION_?> " "when an unsupported I value is specified. In this way, one can " "probe what the current preferred capability revision is." msgstr "" "I のフィールド I にサポートされていない値が指定された場合、 呼" "び出しはエラー B で失敗し、 I にカーネル推奨の " "B<_LINUX_CAPABILITY_VERSION_?> を設定する。 このようにして、現在の推奨ケーパ" "ビリティ・リビジョンが何かを 調べることができる。" #. type: Plain text #: build/C/man2/capget.2:188 msgid "" "Bad memory address. I must not be NULL. I may be NULL only " "when the user is trying to determine the preferred capability version format " "supported by the kernel." msgstr "" "不正なメモリアドレス。 I は NULL であってはならない。 I に NULL " "を指定してよいのは、ユーザがカーネルがサポートしている 推奨のケーパビリティ・" "バージョンを判定しようとしているときだけである。" #. type: TP #: build/C/man2/capget.2:188 build/C/man7/cpuset.7:1180 #: build/C/man7/cpuset.7:1189 build/C/man7/cpuset.7:1198 #: build/C/man7/cpuset.7:1208 build/C/man7/cpuset.7:1217 #: build/C/man7/cpuset.7:1224 build/C/man7/cpuset.7:1231 #: build/C/man2/getgroups.2:114 build/C/man2/getgroups.2:121 #: build/C/man2/getpriority.2:121 build/C/man2/getrlimit.2:440 #: build/C/man2/getrusage.2:191 build/C/man2/iopl.2:72 #: build/C/man2/ioprio_set.2:170 build/C/man2/setpgid.2:225 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/capget.2:191 msgid "One of the arguments was invalid." msgstr "引き数のどれかが無効である。" #. type: Plain text #: build/C/man2/capget.2:196 msgid "" "An attempt was made to add a capability to the Permitted set, or to set a " "capability in the Effective or Inheritable sets that is not in the Permitted " "set." msgstr "" "「許可ケーパビリティセット」にケーパビリティを追加しようとしているか、 もしく" "は「許可ケーパビリティセット」に含まれないケーパビリティを 「実効ケーパビリ" "ティセット」や「継承可能ケーパビリティセット」に セットしようとしている。" #. type: Plain text #: build/C/man2/capget.2:215 msgid "" "The caller attempted to use B() to modify the capabilities of a " "thread other than itself, but lacked sufficient privilege. For kernels " "supporting VFS capabilities, this is never permitted. For kernels lacking " "VFS support, the B capability is required. (A bug in kernels " "before 2.6.11 meant that this error could also occur if a thread without " "this capability tried to change its own capabilities by specifying the " "I field as a nonzero value (i.e., the value returned by B(2)) " "instead of 0.)" msgstr "" "呼び出し元が自分以外のスレッドのケーパビリティを B() を使って修正し" "ようとしたが、十分な特権がなかった。 VFS ケーパビリティをサポートしているカー" "ネルでは、 この操作が許可されることは決してない。 VFS ケーパビリティをサポー" "トしていないカーネルでは、 B ケーパビリティが必要である。 (バー" "ジョン 2.6.11 より前のカーネルには、 このケーパビリティを持たないスレッドが " "I フィールドに 0 でない値 (つまり、0 の代わりに B(2) が返す値) " "を指定して自分自身のケーパビリティを変更しようとした場合にも、 このエラーが発" "生するというバグがあった。)" #. type: TP #: build/C/man2/capget.2:215 build/C/man7/cpuset.7:1330 #: build/C/man2/getpriority.2:129 build/C/man2/getrlimit.2:464 #: build/C/man2/getsid.2:70 build/C/man2/ioprio_set.2:187 #: build/C/man2/setpgid.2:240 #, no-wrap msgid "B" msgstr "B" #. type: Plain text #: build/C/man2/capget.2:218 msgid "No such thread." msgstr "そのようなスレッドが存在しない。" #. type: Plain text #: build/C/man2/capget.2:220 build/C/man2/ioprio_set.2:198 msgid "These system calls are Linux-specific." msgstr "これらのシステムコールは Linux 独自である。" #. type: Plain text #: build/C/man2/capget.2:225 msgid "" "The portable interface to the capability querying and setting functions is " "provided by the I library and is available here:" msgstr "" "ケーパビリティを設定したり取得したりする機能のための移植性ある インターフェー" "スは I ライブラリによって提供される。 このライブラリは以下から入手で" "きる:" #. type: Plain text #: build/C/man2/capget.2:228 msgid "" "E<.UR http://git.kernel.org/cgit\\:/linux\\:/kernel\\:/git\\:/morgan\\:\\:/" "libcap.git> E<.UE>" msgstr "" "E<.UR http://git.kernel.org/cgit\\:/linux\\:/kernel\\:/git\\:/morgan\\:\\:/" "libcap.git> E<.UE>" #. type: Plain text #: build/C/man2/capget.2:232 msgid "B(2), B(2), B(7)" msgstr "B(2), B(2), B(7)" #. type: TH #: build/C/man7/cpuset.7:25 #, no-wrap msgid "CPUSET" msgstr "CPUSET" #. type: TH #: build/C/man7/cpuset.7:25 build/C/man2/getpriority.2:48 #: build/C/man2/ioprio_set.2:24 build/C/man7/svipc.7:40 #, no-wrap msgid "2013-02-12" msgstr "2013-02-12" #. type: Plain text #: build/C/man7/cpuset.7:28 msgid "cpuset - confine processes to processor and memory node subsets" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:35 msgid "" "The cpuset filesystem is a pseudo-filesystem interface to the kernel cpuset " "mechanism, which is used to control the processor placement and memory " "placement of processes. It is commonly mounted at I." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:52 msgid "" "On systems with kernels compiled with built in support for cpusets, all " "processes are attached to a cpuset, and cpusets are always present. If a " "system supports cpusets, then it will have the entry B in the " "file I. By mounting the cpuset filesystem (see the " "B section below), the administrator can configure the cpusets on a " "system to control the processor and memory placement of processes on that " "system. By default, if the cpuset configuration on a system is not modified " "or if the cpuset filesystem is not even mounted, then the cpuset mechanism, " "though present, has no affect on the system's behavior." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:54 msgid "A cpuset defines a list of CPUs and memory nodes." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:63 msgid "" "The CPUs of a system include all the logical processing units on which a " "process can execute, including, if present, multiple processor cores within " "a package and Hyper-Threads within a processor core. Memory nodes include " "all distinct banks of main memory; small and SMP systems typically have just " "one memory node that contains all the system's main memory, while NUMA (non-" "uniform memory access) systems have multiple memory nodes." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:73 msgid "" "Cpusets are represented as directories in a hierarchical pseudo-filesystem, " "where the top directory in the hierarchy (I) represents the " "entire system (all online CPUs and memory nodes) and any cpuset that is the " "child (descendant) of another parent cpuset contains a subset of that " "parent's CPUs and memory nodes. The directories and files representing " "cpusets have normal filesystem permissions." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:84 msgid "" "Every process in the system belongs to exactly one cpuset. A process is " "confined to run only on the CPUs in the cpuset it belongs to, and to " "allocate memory only on the memory nodes in that cpuset. When a process " "B(2)s, the child process is placed in the same cpuset as its parent. " "With sufficient privilege, a process may be moved from one cpuset to another " "and the allowed CPUs and memory nodes of an existing cpuset may be changed." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:92 msgid "" "When the system begins booting, a single cpuset is defined that includes all " "CPUs and memory nodes on the system, and all processes are in that cpuset. " "During the boot process, or later during normal system operation, other " "cpusets may be created, as subdirectories of this top cpuset, under the " "control of the system administrator, and processes may be placed in these " "other cpusets." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:114 msgid "" "Cpusets are integrated with the B(2) scheduling affinity " "mechanism and the B(2) and B(2) memory-placement " "mechanisms in the kernel. Neither of these mechanisms let a process make " "use of a CPU or memory node that is not allowed by that process's cpuset. " "If changes to a process's cpuset placement conflict with these other " "mechanisms, then cpuset placement is enforced even if it means overriding " "these other mechanisms. The kernel accomplishes this overriding by silently " "restricting the CPUs and memory nodes requested by these other mechanisms to " "those allowed by the invoking process's cpuset. This can result in these " "other calls returning an error, if for example, such a call ends up " "requesting an empty set of CPUs or memory nodes, after that request is " "restricted to the invoking process's cpuset." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:120 msgid "" "Typically, a cpuset is used to manage the CPU and memory-node confinement " "for a set of cooperating processes such as a batch scheduler job, and these " "other mechanisms are used to manage the placement of individual processes or " "memory regions within that set or job." msgstr "" #. type: SH #: build/C/man7/cpuset.7:120 #, no-wrap msgid "FILES" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:125 msgid "" "Each directory below I represents a cpuset and contains a fixed " "set of pseudo-files describing the state of that cpuset." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:135 msgid "" "New cpusets are created using the B(2) system call or the B" "(1) command. The properties of a cpuset, such as its flags, allowed CPUs " "and memory nodes, and attached processes, are queried and modified by " "reading or writing to the appropriate file in that cpuset's directory, as " "listed below." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:141 msgid "" "The pseudo-files in each cpuset directory are automatically created when the " "cpuset is created, as a result of the B(2) invocation. It is not " "possible to directly add or remove these pseudo-files." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:149 msgid "" "A cpuset directory that contains no child cpuset directories, and has no " "attached processes, can be removed using B(2) or B(1). It is " "not necessary, or possible, to remove the pseudo-files inside the directory " "before removing it." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:163 msgid "" "The pseudo-files in each cpuset directory are small text files that may be " "read and written using traditional shell utilities such as B(1), and " "B(1), or from a program by using file I/O library functions or system " "calls, such as B(2), B(2), B(2), and B(2)." msgstr "" #. ====================== tasks ====================== #. type: Plain text #: build/C/man7/cpuset.7:168 msgid "" "The pseudo-files in a cpuset directory represent internal kernel state and " "do not have any persistent image on disk. Each of these per-cpuset files is " "listed and described below." msgstr "" #. type: TP #: build/C/man7/cpuset.7:168 #, no-wrap msgid "I" msgstr "I" #. type: Plain text #: build/C/man7/cpuset.7:178 msgid "" "List of the process IDs (PIDs) of the processes in that cpuset. The list is " "formatted as a series of ASCII decimal numbers, each followed by a newline. " "A process may be added to a cpuset (automatically removing it from the " "cpuset that previously contained it) by writing its PID to that cpuset's " "I file (with or without a trailing newline.)" msgstr "" #. =================== notify_on_release =================== #. type: Plain text #: build/C/man7/cpuset.7:186 msgid "" "B only one PID may be written to the I file at a time. If " "a string is written that contains more than one PID, only the first one will " "be used." msgstr "" #. type: TP #: build/C/man7/cpuset.7:186 #, no-wrap msgid "I" msgstr "I" #. ====================== cpus ====================== #. type: Plain text #: build/C/man7/cpuset.7:195 msgid "" "Flag (0 or 1). If set (1), that cpuset will receive special handling after " "it is released, that is, after all processes cease using it (i.e., terminate " "or are moved to a different cpuset) and all child cpuset directories have " "been removed. See the B section, below." msgstr "" #. type: TP #: build/C/man7/cpuset.7:195 #, no-wrap msgid "I" msgstr "I" #. type: Plain text #: build/C/man7/cpuset.7:202 msgid "" "List of the physical numbers of the CPUs on which processes in that cpuset " "are allowed to execute. See B below for a description of the " "format of I." msgstr "" #. ==================== cpu_exclusive ==================== #. type: Plain text #: build/C/man7/cpuset.7:208 msgid "" "The CPUs allowed to a cpuset may be changed by writing a new list to its " "I file." msgstr "" #. type: TP #: build/C/man7/cpuset.7:208 #, no-wrap msgid "I" msgstr "I" #. type: Plain text #: build/C/man7/cpuset.7:215 msgid "" "Flag (0 or 1). If set (1), the cpuset has exclusive use of its CPUs (no " "sibling or cousin cpuset may overlap CPUs). By default this is off (0). " "Newly created cpusets also initially default this to off (0)." msgstr "" #. ====================== mems ====================== #. type: Plain text #: build/C/man7/cpuset.7:237 msgid "" "Two cpusets are I cpusets if they share the same parent cpuset in " "the I hierarchy. Two cpusets are I cpusets if neither " "is the ancestor of the other. Regardless of the I setting, " "if one cpuset is the ancestor of another, and if both of these cpusets have " "nonempty I, then their I must overlap, because the I of " "any cpuset are always a subset of the I of its parent cpuset." msgstr "" #. type: TP #: build/C/man7/cpuset.7:237 #, no-wrap msgid "I" msgstr "I" #. ==================== mem_exclusive ==================== #. type: Plain text #: build/C/man7/cpuset.7:245 msgid "" "List of memory nodes on which processes in this cpuset are allowed to " "allocate memory. See B below for a description of the format " "of I." msgstr "" #. type: TP #: build/C/man7/cpuset.7:245 #, no-wrap msgid "I" msgstr "I" #. type: Plain text #: build/C/man7/cpuset.7:253 msgid "" "Flag (0 or 1). If set (1), the cpuset has exclusive use of its memory nodes " "(no sibling or cousin may overlap). Also if set (1), the cpuset is a " "B cpuset (see below.) By default this is off (0). Newly created " "cpusets also initially default this to off (0)." msgstr "" #. ==================== mem_hardwall ==================== #. type: Plain text #: build/C/man7/cpuset.7:261 msgid "" "Regardless of the I setting, if one cpuset is the ancestor of " "another, then their memory nodes must overlap, because the memory nodes of " "any cpuset are always a subset of the memory nodes of that cpuset's parent " "cpuset." msgstr "" #. type: TP #: build/C/man7/cpuset.7:261 #, no-wrap msgid "I (since Linux 2.6.26)" msgstr "I (Linux 2.6.26 以降)" #. ==================== memory_migrate ==================== #. type: Plain text #: build/C/man7/cpuset.7:272 msgid "" "Flag (0 or 1). If set (1), the cpuset is a B cpuset (see below.) " "Unlike B, there is no constraint on whether cpusets marked " "B may have overlapping memory nodes with sibling or cousin " "cpusets. By default this is off (0). Newly created cpusets also initially " "default this to off (0)." msgstr "" #. type: TP #: build/C/man7/cpuset.7:272 #, no-wrap msgid "I (since Linux 2.6.16)" msgstr "I (Linux 2.6.16 以降)" #. ==================== memory_pressure ==================== #. type: Plain text #: build/C/man7/cpuset.7:279 msgid "" "Flag (0 or 1). If set (1), then memory migration is enabled. By default " "this is off (0). See the B section, below." msgstr "" #. type: TP #: build/C/man7/cpuset.7:279 #, no-wrap msgid "I (since Linux 2.6.16)" msgstr "I (Linux 2.6.16 以降)" #. ================= memory_pressure_enabled ================= #. type: Plain text #: build/C/man7/cpuset.7:292 msgid "" "A measure of how much memory pressure the processes in this cpuset are " "causing. See the B section, below. Unless " "I is enabled, always has value zero (0). This file " "is read-only. See the B section, below." msgstr "" #. type: TP #: build/C/man7/cpuset.7:292 #, no-wrap msgid "I (since Linux 2.6.16)" msgstr "I (Linux 2.6.16 以降)" #. ================== memory_spread_page ================== #. type: Plain text #: build/C/man7/cpuset.7:304 msgid "" "Flag (0 or 1). This file is present only in the root cpuset, normally I. If set (1), the I calculations are enabled " "for all cpusets in the system. By default this is off (0). See the " "B section, below." msgstr "" #. type: TP #: build/C/man7/cpuset.7:304 #, no-wrap msgid "I (since Linux 2.6.17)" msgstr "I (Linux 2.6.17 以降)" #. ================== memory_spread_slab ================== #. type: Plain text #: build/C/man7/cpuset.7:314 msgid "" "Flag (0 or 1). If set (1), pages in the kernel page cache (filesystem " "buffers) are uniformly spread across the cpuset. By default this is off (0) " "in the top cpuset, and inherited from the parent cpuset in newly created " "cpusets. See the B section, below." msgstr "" #. type: TP #: build/C/man7/cpuset.7:314 #, no-wrap msgid "I (since Linux 2.6.17)" msgstr "I (Linux 2.6.17 以降)" #. ================== sched_load_balance ================== #. type: Plain text #: build/C/man7/cpuset.7:325 msgid "" "Flag (0 or 1). If set (1), the kernel slab caches for file I/O (directory " "and inode structures) are uniformly spread across the cpuset. By default " "this is off (0) in the top cpuset, and inherited from the parent cpuset in " "newly created cpusets. See the B section, below." msgstr "" #. type: TP #: build/C/man7/cpuset.7:325 #, no-wrap msgid "I (since Linux 2.6.24)" msgstr "I (Linux 2.6.24 以降)" #. ================== sched_relax_domain_level ================== #. type: Plain text #: build/C/man7/cpuset.7:339 msgid "" "Flag (0 or 1). If set (1, the default) the kernel will automatically load " "balance processes in that cpuset over the allowed CPUs in that cpuset. If " "cleared (0) the kernel will avoid load balancing processes in this cpuset, " "I some other cpuset with overlapping CPUs has its " "I flag set. See B, below, for " "further details." msgstr "" #. type: TP #: build/C/man7/cpuset.7:339 #, no-wrap msgid "I (since Linux 2.6.26)" msgstr "I (Linux 2.6.26 以降)" #. ================== proc cpuset ================== #. type: Plain text #: build/C/man7/cpuset.7:359 msgid "" "Integer, between -1 and a small positive value. The " "I controls the width of the range of CPUs over " "which the kernel scheduler performs immediate rebalancing of runnable tasks " "across CPUs. If I is disabled, then the setting of " "I does not matter, as no such load balancing is " "done. If I is enabled, then the higher the value of the " "I, the wider the range of CPUs over which " "immediate load balancing is attempted. See B, " "below, for further details." msgstr "" #. ================== proc status ================== #. type: Plain text #: build/C/man7/cpuset.7:367 msgid "" "In addition to the above pseudo-files in each directory below I, each process has a pseudo-file, IpidE/cpuset>, that " "displays the path of the process's cpuset directory relative to the root of " "the cpuset filesystem." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:378 msgid "" "Also the IpidE/status> file for each process has four added " "lines, displaying the process's I (on which CPUs it may be " "scheduled) and I (on which memory nodes it may obtain memory), " "in the two formats B and B (see below) as shown " "in the following example:" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:385 #, no-wrap msgid "" "Cpus_allowed: ffffffff,ffffffff,ffffffff,ffffffff\n" "Cpus_allowed_list: 0-127\n" "Mems_allowed: ffffffff,ffffffff\n" "Mems_allowed_list: 0-63\n" msgstr "" "Cpus_allowed: ffffffff,ffffffff,ffffffff,ffffffff\n" "Cpus_allowed_list: 0-127\n" "Mems_allowed: ffffffff,ffffffff\n" "Mems_allowed_list: 0-63\n" #. ================== EXTENDED CAPABILITIES ================== #. type: Plain text #: build/C/man7/cpuset.7:391 msgid "" "The \"allowed\" fields were added in Linux 2.6.24; the \"allowed_list\" " "fields were added in Linux 2.6.26." msgstr "" #. type: SH #: build/C/man7/cpuset.7:391 #, no-wrap msgid "EXTENDED CAPABILITIES" msgstr "" #. ================== Exclusive Cpusets ================== #. type: Plain text #: build/C/man7/cpuset.7:399 msgid "" "In addition to controlling which I and I a process is allowed to " "use, cpusets provide the following extended capabilities." msgstr "" #. type: SS #: build/C/man7/cpuset.7:399 #, no-wrap msgid "Exclusive cpusets" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:406 msgid "" "If a cpuset is marked I or I, no other cpuset, " "other than a direct ancestor or descendant, may share any of the same CPUs " "or memory nodes." msgstr "" #. ================== Hardwall ================== #. type: Plain text #: build/C/man7/cpuset.7:432 msgid "" "A cpuset that is I restricts kernel allocations for buffer " "cache pages and other internal kernel data pages commonly shared by the " "kernel across multiple users. All cpusets, whether I or not, " "restrict allocations of memory for user space. This enables configuring a " "system so that several independent jobs can share common kernel data, while " "isolating each job's user allocation in its own cpuset. To do this, " "construct a large I cpuset to hold all the jobs, and " "construct child, non-I cpusets for each individual job. Only " "a small amount of kernel memory, such as requests from interrupt handlers, " "is allowed to be placed on memory nodes outside even a I " "cpuset." msgstr "" #. type: SS #: build/C/man7/cpuset.7:432 #, no-wrap msgid "Hardwall" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:447 msgid "" "A cpuset that has I or I set is a I " "cpuset. A I cpuset restricts kernel allocations for page, buffer, " "and other data commonly shared by the kernel across multiple users. All " "cpusets, whether I or not, restrict allocations of memory for user " "space." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:458 msgid "" "This enables configuring a system so that several independent jobs can share " "common kernel data, such as filesystem pages, while isolating each job's " "user allocation in its own cpuset. To do this, construct a large " "I cpuset to hold all the jobs, and construct child cpusets for " "each individual job which are not I cpusets." msgstr "" #. ================== Notify On Release ================== #. type: Plain text #: build/C/man7/cpuset.7:464 msgid "" "Only a small amount of kernel memory, such as requests from interrupt " "handlers, is allowed to be taken outside even a I cpuset." msgstr "" #. type: SS #: build/C/man7/cpuset.7:464 #, no-wrap msgid "Notify on release" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:476 msgid "" "If the I flag is enabled (1) in a cpuset, then whenever " "the last process in the cpuset leaves (exits or attaches to some other " "cpuset) and the last child cpuset of that cpuset is removed, the kernel " "will run the command I, supplying the pathname " "(relative to the mount point of the cpuset filesystem) of the abandoned " "cpuset. This enables automatic removal of abandoned cpusets." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:484 msgid "" "The default value of I in the root cpuset at system boot " "is disabled (0). The default value of other cpusets at creation is the " "current value of their parent's I setting." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:492 msgid "" "The command I is invoked, with the name (I relative path) of the to-be-released cpuset in I." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:496 msgid "" "The usual contents of the command I is simply " "the shell script:" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:501 #, no-wrap msgid "" "#!/bin/sh\n" "rmdir /dev/cpuset/$1\n" msgstr "" "#!/bin/sh\n" "rmdir /dev/cpuset/$1\n" #. ================== Memory Pressure ================== #. type: Plain text #: build/C/man7/cpuset.7:509 msgid "" "As with other flag values below, this flag can be changed by writing an " "ASCII number 0 or 1 (with optional trailing newline) into the file, to " "clear or set the flag, respectively." msgstr "" #. type: SS #: build/C/man7/cpuset.7:509 #, no-wrap msgid "Memory pressure" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:515 msgid "" "The I of a cpuset provides a simple per-cpuset running " "average of the rate that the processes in a cpuset are attempting to free up " "in-use memory on the nodes of the cpuset to satisfy additional memory " "requests." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:519 msgid "" "This enables batch managers that are monitoring jobs running in dedicated " "cpusets to efficiently detect what level of memory pressure that job is " "causing." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:526 msgid "" "This is useful both on tightly managed systems running a wide mix of " "submitted jobs, which may choose to terminate or reprioritize jobs that are " "trying to use more memory than allowed on the nodes assigned them, and with " "tightly coupled, long-running, massively parallel scientific computing jobs " "that will dramatically fail to meet required performance goals if they start " "to use more memory than allowed to them." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:531 msgid "" "This mechanism provides a very economical way for the batch manager to " "monitor a cpuset for signs of memory pressure. It's up to the batch manager " "or other user code to decide what action to take if it detects signs of " "memory pressure." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:538 msgid "" "Unless memory pressure calculation is enabled by setting the pseudo-file I, it is not computed for any " "cpuset, and reads from any I always return zero, as " "represented by the ASCII string \"0\\en\". See the B section, " "below." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:540 msgid "A per-cpuset, running average is employed for the following reasons:" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:545 msgid "" "Because this meter is per-cpuset rather than per-process or per virtual " "memory region, the system load imposed by a batch scheduler monitoring this " "metric is sharply reduced on large systems, because a scan of the tasklist " "can be avoided on each set of queries." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:550 msgid "" "Because this meter is a running average rather than an accumulating counter, " "a batch scheduler can detect memory pressure with a single read, instead of " "having to read and accumulate results for a period of time." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:556 msgid "" "Because this meter is per-cpuset rather than per-process, the batch " "scheduler can obtain the key information\\(emmemory pressure in a cpuset" "\\(emwith a single read, rather than having to query and accumulate results " "over all the (dynamically changing) set of processes in the cpuset." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:564 msgid "" "The I of a cpuset is calculated using a per-cpuset simple " "digital filter that is kept within the kernel. For each cpuset, this filter " "tracks the recent rate at which processes attached to that cpuset enter the " "kernel direct reclaim code." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:573 msgid "" "The kernel direct reclaim code is entered whenever a process has to satisfy " "a memory page request by first finding some other page to repurpose, due to " "lack of any readily available already free pages. Dirty filesystem pages " "are repurposed by first writing them to disk. Unmodified filesystem buffer " "pages are repurposed by simply dropping them, though if that page is needed " "again, it will have to be reread from disk." msgstr "" #. ================== Memory Spread ================== #. type: Plain text #: build/C/man7/cpuset.7:581 msgid "" "The I file provides an integer number representing " "the recent (half-life of 10 seconds) rate of entries to the direct reclaim " "code caused by any process in the cpuset, in units of reclaims attempted per " "second, times 1000." msgstr "" #. type: SS #: build/C/man7/cpuset.7:581 #, no-wrap msgid "Memory spread" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:589 msgid "" "There are two Boolean flag files per cpuset that control where the kernel " "allocates pages for the filesystem buffers and related in-kernel data " "structures. They are called I and I." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:596 msgid "" "If the per-cpuset Boolean flag file I is set, " "then the kernel will spread the filesystem buffers (page cache) evenly over " "all the nodes that the faulting process is allowed to use, instead of " "preferring to put those pages on the node where the process is running." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:604 msgid "" "If the per-cpuset Boolean flag file I is set, " "then the kernel will spread some filesystem-related slab caches, such as " "those for inodes and directory entries, evenly over all the nodes that the " "faulting process is allowed to use, instead of preferring to put those pages " "on the node where the process is running." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:609 msgid "" "The setting of these flags does not affect the data segment (see B(2)) " "or stack segment pages of a process." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:617 msgid "" "By default, both kinds of memory spreading are off and the kernel prefers to " "allocate memory pages on the node local to where the requesting process is " "running. If that node is not allowed by the process's NUMA memory policy or " "cpuset configuration or if there are insufficient free memory pages on that " "node, then the kernel looks for the nearest node that is allowed and has " "sufficient free memory." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:620 msgid "" "When new cpusets are created, they inherit the memory spread settings of " "their parent." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:635 msgid "" "Setting memory spreading causes allocations for the affected page or slab " "caches to ignore the process's NUMA memory policy and be spread instead. " "However, the effect of these changes in memory placement caused by cpuset-" "specified memory spreading is hidden from the B(2) or " "B(2) calls. These two NUMA memory policy calls always " "appear to behave as if no cpuset-specified memory spreading is in effect, " "even if it is. If cpuset memory spreading is subsequently turned off, the " "NUMA memory policy most recently specified by these calls is automatically " "reapplied." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:644 msgid "" "Both I and I are " "Boolean flag files. By default they contain \"0\", meaning that the feature " "is off for that cpuset. If a \"1\" is written to that file, that turns the " "named feature on." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:647 msgid "" "Cpuset-specified memory spreading behaves similarly to what is known (in " "other contexts) as round-robin or interleave memory placement." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:650 msgid "" "Cpuset-specified memory spreading can provide substantial performance " "improvements for jobs that:" msgstr "" #. type: IP #: build/C/man7/cpuset.7:650 #, no-wrap msgid "a)" msgstr "a)" #. type: Plain text #: build/C/man7/cpuset.7:654 msgid "" "need to place thread-local data on memory nodes close to the CPUs which are " "running the threads that most frequently access that data; but also" msgstr "" #. type: IP #: build/C/man7/cpuset.7:654 #, no-wrap msgid "b)" msgstr "b)" #. type: Plain text #: build/C/man7/cpuset.7:657 msgid "" "need to access large filesystem data sets that must to be spread across the " "several nodes in the job's cpuset in order to fit." msgstr "" #. ================== Memory Migration ================== #. type: Plain text #: build/C/man7/cpuset.7:664 msgid "" "Without this policy, the memory allocation across the nodes in the job's " "cpuset can become very uneven, especially for jobs that might have just a " "single thread initializing or reading in the data set." msgstr "" #. type: SS #: build/C/man7/cpuset.7:664 #, no-wrap msgid "Memory migration" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:673 msgid "" "Normally, under the default setting (disabled) of I, " "once a page is allocated (given a physical page of main memory) then that " "page stays on whatever node it was allocated, so long as it remains " "allocated, even if the cpuset's memory-placement policy I subsequently " "changes." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:679 msgid "" "When memory migration is enabled in a cpuset, if the I setting of the " "cpuset is changed, then any memory page in use by any process in the cpuset " "that is on a memory node that is no longer allowed will be migrated to a " "memory node that is allowed." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:685 msgid "" "Furthermore, if a process is moved into a cpuset with I " "enabled, any memory pages it uses that were on memory nodes allowed in its " "previous cpuset, but which are not allowed in its new cpuset, will be " "migrated to a memory node allowed in the new cpuset." msgstr "" #. ================== Scheduler Load Balancing ================== #. type: Plain text #: build/C/man7/cpuset.7:693 msgid "" "The relative placement of a migrated page within the cpuset is preserved " "during these migration operations if possible. For example, if the page was " "on the second valid node of the prior cpuset, then the page will be placed " "on the second valid node of the new cpuset, if possible." msgstr "" #. type: SS #: build/C/man7/cpuset.7:693 #, no-wrap msgid "Scheduler load balancing" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:700 msgid "" "The kernel scheduler automatically load balances processes. If one CPU is " "underutilized, the kernel will look for processes on other more overloaded " "CPUs and move those processes to the underutilized CPU, within the " "constraints of such placement mechanisms as cpusets and B" "(2)." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:713 msgid "" "The algorithmic cost of load balancing and its impact on key shared kernel " "data structures such as the process list increases more than linearly with " "the number of CPUs being balanced. For example, it costs more to load " "balance across one large set of CPUs than it does to balance across two " "smaller sets of CPUs, each of half the size of the larger set. (The precise " "relationship between the number of CPUs being balanced and the cost of load " "balancing depends on implementation details of the kernel process scheduler, " "which is subject to change over time, as improved kernel scheduler " "algorithms are implemented.)" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:719 msgid "" "The per-cpuset flag I provides a mechanism to suppress " "this automatic scheduler load balancing in cases where it is not needed and " "suppressing it would have worthwhile performance benefits." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:723 msgid "" "By default, load balancing is done across all CPUs, except those marked " "isolated using the kernel boot time \"isolcpus=\" argument. (See " "B, below, to change this default.)" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:726 msgid "" "This default load balancing across all CPUs is not well suited to the " "following two situations:" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:730 msgid "" "On large systems, load balancing across many CPUs is expensive. If the " "system is managed using cpusets to place independent jobs on separate sets " "of CPUs, full load balancing is unnecessary." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:734 msgid "" "Systems supporting real-time on some CPUs need to minimize system overhead " "on those CPUs, including avoiding process load balancing if that is not " "needed." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:744 msgid "" "When the per-cpuset flag I is enabled (the default " "setting), it requests load balancing across all the CPUs in that cpuset's " "allowed CPUs, ensuring that load balancing can move a process (not otherwise " "pinned, as by B(2)) from any CPU in that cpuset to any " "other." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:753 msgid "" "When the per-cpuset flag I is disabled, then the " "scheduler will avoid load balancing across the CPUs in that cpuset, " "I in so far as is necessary because some overlapping cpuset has " "I enabled." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:761 msgid "" "So, for example, if the top cpuset has the flag I " "enabled, then the scheduler will load balance across all CPUs, and the " "setting of the I flag in other cpusets has no effect, as " "we're already fully load balancing." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:766 msgid "" "Therefore in the above two situations, the flag I should " "be disabled in the top cpuset, and only some of the smaller, child cpusets " "would have this flag enabled." msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:774 msgid "" "When doing this, you don't usually want to leave any unpinned processes in " "the top cpuset that might use nontrivial amounts of CPU, as such processes " "may be artificially constrained to some subset of CPUs, depending on the " "particulars of this flag setting in descendant cpusets. Even if such a " "process could use spare CPU cycles in some other CPUs, the kernel scheduler " "might not consider the possibility of load balancing that process to the " "underused CPU." msgstr "" #. ================== Scheduler Relax Domain Level ================== #. type: Plain text #: build/C/man7/cpuset.7:780 msgid "" "Of course, processes pinned to a particular CPU can be left in a cpuset that " "disables I as those processes aren't going anywhere else " "anyway." msgstr "" #. type: SS #: build/C/man7/cpuset.7:780 #, no-wrap msgid "Scheduler relax domain level" msgstr "" #. type: Plain text #: build/C/man7/cpuset.7:801 msgid "" "The kernel scheduler performs immediate load balancing whenever a CPU " "becomes free or another task becomes runnable. This load balancing works to " "ensure that as many CPUs as possible are usefully employed running tasks. " "The kernel also performs periodic load balancing off the software clock " "described in B