1.\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved. 2.\" The contents of this file are subject to the terms of the Common 3.\" Development and Distribution License (the "License"). You may not use 4.\" this file except in compliance with the License. You can obtain a copy 5.\" of the license at usr/src/OPENSOLARIS.LICENSE or 6.\" http://www.opensolaris.org/os/licensing. 7.\" 8.\" See the License for the specific language governing permissions and 9.\" limitations under the License. When distributing Covered Code, include 10.\" this CDDL HEADER in each file and include the License file at 11.\" usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below 12.\" this CDDL HEADER, with 13.\" 14.\" the fields enclosed by brackets "[]" replaced with your own identifying 15.\" information: Portions Copyright [yyyy] [name of copyright owner] 16.\" 17.\" Copyright 2026 OmniOS Community Edition (OmniOSce) Association. 18.\" 19.Dd August 8, 2026 20.Dt GETPFLAGS 2 21.Os 22.Sh NAME 23.Nm getpflags , 24.Nm setpflags 25.Nd get or set process flags 26.Sh SYNOPSIS 27.In sys/types.h 28.In priv.h 29.Ft uint_t 30.Fo getpflags 31.Fa "uint_t flag" 32.Fc 33.Ft int 34.Fo setpflags 35.Fa "uint_t flag" 36.Fa "uint_t value" 37.Fc 38.Sh DESCRIPTION 39.Fn getpflags 40and 41.Fn setpflags 42obtain and modify the current per-process flags. 43.Pp 44The following values for 45.Fa flag 46are supported: 47.Bl -tag -width Ds 48.It Dv PRIV_AWARE 49This one bit flag takes the value of 0 50.Pq unset 51or 1 52.Pq set . 53Only if this flag is set is the current process privilege-aware. 54A process can attempt to unset this flag but might fail silently if the 55observed set invariance condition cannot be met. 56Setting this flag is always successful. 57See 58.Xr privileges 7 59for a discussion of this flag. 60.It Dv PRIV_AWARE_RESET 61This one bit flag takes the value of 0 62.Pq unset 63or 1 64.Pq set . 65This causes a process to pretend it is non-privilege-aware. 66The effective and permitted privilege set change on the change of the effective 67uid. 68When all the uid sets become the same through 69.Xr setuid 2 70or through 71.Xr setreuid 2 , 72the effective and permitted set are set to the intersection between the limit 73set and the inheritable set. 74At that point, both 75.Dv PRIV_AWARE 76and 77.Dv PRIV_AWARE_RESET 78are unset. 79.Pp 80This flag gets automatically reset when a process becomes privilege aware, 81either through calling 82.Xr setppriv 2 83or by setting 84.Dv PRIV_AWARE 85to 1. 86.It Dv PRIV_PFEXEC 87This one bit flag takes the value of 0 88.Pq unset 89or 1 90.Pq set . 91If this flag is set then calls to 92.Xr exec 2 93trigger lookups in the 94.Xr exec_attr 5 95database for the current user's profiles and the returned attributes will be 96applied to the new process image. 97This flag is inherited by the new process image unless the returned attributes 98cause a real user ID change. 99.It Dv PRIV_DEBUG 100This one bit flag takes the value of 0 101.Pq unset 102or 1 103.Pq set . 104Only if this flag is set does the current process have privilege debugging 105enabled. 106Processes can set and unset this flag at will. 107.It Dv NET_MAC_AWARE , NET_MAC_AWARE_INHERIT 108These flags are available only if the system is configured with Trusted 109Extensions. 110These one bit flags each take the value of 0 111.Pq unset 112or 1 113.Pq set . 114If the 115.Dv NET_MAC_AWARE 116flag is set then the current process is allowed to communicate with peers at 117labels that are different than its own, subject to MAC policy. 118.Pp 119The 120.Dv NET_MAC_AWARE_INHERIT 121flag controls the propagation of the 122.Dv NET_MAC_AWARE 123flag. 124When a process performs one of the 125.Xr exec 2 126functions, the 127.Dv NET_MAC_AWARE 128flag is unset unless the 129.Dv NET_MAC_AWARE_INHERIT 130is set. 131.Dv NET_MAC_AWARE_INHERIT 132is always unset on one of the 133.Xr exec 2 134functions. 135The 136.Dv PRIV_NET_MAC_AWARE 137privilege is required to set either of these flags. 138.El 139.Sh RETURN VALUES 140.Fn getpflags 141returns the value associated with a given per-process flag. 142If the 143.Fa flag 144argument is invalid, (uint_t)\(mi1 is returned and 145.Va errno 146is set to indicate the error. 147.Pp 148Upon successful completion, 149.Fn setpflags 150returns 0. 151Otherwise, -1 is returned and 152.Va errno 153is set to indicate the error. 154.Sh ERRORS 155.Fn getpflags 156and 157.Fn setpflags 158will fail if: 159.Bl -tag -width Ds 160.It Er EINVAL 161The value of 162.Fa flag 163or the value to which the 164.Fa flag 165is set is out of range. 166.El 167.Pp 168.Fn setpflags 169will fail if: 170.Bl -tag -width Ds 171.It Er EPERM 172An attempt was made to unset 173.Dv PRIV_AWARE 174but the observed set invariance condition was not met. 175.It Er EPERM 176An attempt was made to set one of the 177.Dv NET_MAC_AWARE 178or 179.Dv NET_MAC_AWARE_INHERIT 180flags without the necessary 181.Dv PRIV_NET_MAC_AWARE 182privilege. 183.El 184.Sh INTERFACE STABILITY 185.Sy Committed 186.Sh MT-LEVEL 187.Sy Async-Signal-Safe 188.Sh SEE ALSO 189.Xr ppriv 1 , 190.Xr exec 2 , 191.Xr setppriv 2 , 192.Xr setreuid 2 , 193.Xr setuid 2 , 194.Xr attributes 7 , 195.Xr privileges 7 196