rpm

package: rpm

title: rpm(8)

summary: RPM Package Manager

text:
# rpm(8)

## NAME
rpm - RPM Package Manager

## SYNOPSIS

### QUERYING AND VERIFYING PACKAGES:
rpm {-q|--query} [select-options] [query-options]

rpm --querytags

rpm {-V|--verify} [select-options] [verify-options]

### INSTALLING, UPGRADING, AND REMOVING PACKAGES:
rpm {-i|--install} [install-options] PACKAGE_FILE ...

rpm {-U|--upgrade} [install-options] PACKAGE_FILE ...

rpm {-F|--freshen} [install-options] PACKAGE_FILE ...

rpm {--reinstall} [install-options] PACKAGE_FILE ...

rpm {-e|--erase} [--allmatches] [--nodeps] [--noscripts]

[--notriggers] [--test] PACKAGE_NAME ...

### MISCELLANEOUS:
rpm --showrc

rpm --setperms PACKAGE_NAME ...

rpm --setugids PACKAGE_NAME ...

### select-options

[PACKAGE_NAME] [-a,--all] [-f,--file FILE]

[-g,--group GROUP] {-p,--package PACKAGE_FILE]

[--hdrid SHA1] [--pkgid MD5] [--tid TID]

[--querybynumber HDRNUM] [--triggeredby PACKAGE_NAME]

[--whatprovides CAPABILITY] [--whatrequires CAPABILITY]

[--whatrecommends CAPABILITY] [--whatsuggests CAPABILITY]

[--whatsupplements CAPABILITY] [--whatenhances CAPABILITY]

### query-options

[--changelog] [-c,--configfiles] [--conflicts]

[-d,--docfiles] [--dump] [--enhances] [--filesbypkg]

[-i,--info] [--last] [-l,--list] [--obsoletes]

[--provides] [--qf,--queryformat QUERYFMT]

[--recommends] [-R,--requires] [--suggests]

[--supplements] [--scripts] [-s,--state]

[--triggers,--triggerscripts]

### verify-options

[--nodeps] [--nofiles] [--noscripts]

[--nodigest] [--nosignature]

[--nolinkto] [--nofiledigest] [--nosize] [--nouser]

[--nogroup] [--nomtime] [--nomode] [--nordev]

[--nocaps]

### install-options

[--allfiles] [--badreloc] [--excludepath OLDPATH]

[--excludedocs] [--force] [-h,--hash]

[--ignoresize] [--ignorearch] [--ignoreos]

[--includedocs] [--justdb] [--nocollections]

[--nodeps] [--nodigest] [--nosignature]

[--noorder] [--noscripts] [--notriggers]

[--oldpackage] [--percent] [--prefix NEWPATH]

[--relocate OLDPATH=NEWPATH]

[--replacefiles] [--replacepkgs]

[--test]

## DESCRIPTION
rpm is a powerful Package Manager, which can be used to build, install, query, verify, update, and erase individual software packages. A package consists of an archive of files and meta-data used to install and erase the archive files. The meta-data includes helper scripts, file attributes, and descriptive information about the package. Packages come in two varieties: binary packages, used to encapsulate software to be installed, and source packages, containing the source code and recipe necessary to produce binary packages.

One of the following basic modes must be selected: Query, Verify, Install/Upgrade/Freshen/Reinstall, Uninstall, Set Owners/Groups, Show Querytags, and Show Configuration.

### GENERAL OPTIONS
These options can be used in all the different modes.

-?, --help

Print a longer usage message then normal.

--version

Print a single line containing the version number of rpm being used.

--quiet

Print as little as possible - normally only error messages will be displayed.

-v

Print verbose information - normally routine progress messages will be displayed.

-vv

Print lots of ugly debugging information.

--rcfile FILELIST

Each of the files in the colon separated FILELIST is read sequentially by rpm for configuration information. Only the first file in the list must exist, and tildes will be expanded to the value of $HOME. The default FILELIST is /usr/lib/rpm/rpmrc:/usr/lib/rpm/redhat/rpmrc:/etc/rpmrc:~/.rpmrc.

--pipe CMD

Pipes the output of rpm to the command CMD.

--dbpath DIRECTORY

Use the database in DIRECTORY rather than the default path /var/lib/rpm

--root DIRECTORY

Use the file system tree rooted at DIRECTORY for all operations. Note that this means the database within DIRECTORY will be used for dependency checks and any scriptlet(s) (e.g. %post if installing, or %prep if building, a package) will be run after a chroot(2) to DIRECTORY.

-D, --define='MACRO EXPR'

Defines MACRO with value EXPR.

--undefine='MACRO'

Undefines MACRO.

-E, --eval='EXPR'

Prints macro expansion of EXPR.

### INSTALL AND UPGRADE OPTIONS
In these options, PACKAGE_FILE can be either rpm binary file or ASCII package manifest (see PACKAGE SELECTION OPTIONS), and may be specified as an ftp or http URL, in which case the package will be downloaded before being installed. See FTP/HTTP OPTIONS for information on rpm's internal ftp and http client support.

The general form of an rpm install command is

rpm {-i|--install} [install-options] PACKAGE_FILE ...

This installs a new package.

The general form of an rpm upgrade command is

rpm {-U|--upgrade} [install-options] PACKAGE_FILE ...

This upgrades or installs the package currently installed to a newer version. This is the same as install, except all other version(s) of the package are removed after the new package is installed.

rpm {-F|--freshen} [install-options] PACKAGE_FILE ...

This will upgrade packages, but only ones for which an earlier version is installed.

The general form of an rpm reinstall command is

rpm {--reinstall} [install-options] PACKAGE_FILE ...

This reinstalls a previously installed package.

--allfiles

Installs or upgrades all the missingok files in the package, regardless if they exist.

--badreloc

Used with --relocate, permit relocations on all file paths, not just those OLDPATH's included in the binary package relocation hint(s).

--excludepath OLDPATH

Don't install files whose name begins with OLDPATH.

--excludedocs

Don't install any files which are marked as documentation (which includes man pages and texinfo documents).

--force

Same as using --replacepkgs, --replacefiles, and --oldpackage.

-h, --hash

Print 50 hash marks as the package archive is unpacked. Use with -v|--verbose for a nicer display.

--ignoresize

Don't check mount file systems for sufficient disk space before installing this package.

--ignorearch

Allow installation or upgrading even if the architectures of the binary package and host don't match.

--ignoreos

Allow installation or upgrading even if the operating systems of the binary package and host don't match.

--includedocs

Install documentation files. This is the default behavior.

--justdb

Update only the database, not the filesystem.

--nodigest

Don't verify package or header digests when reading.

--nomanifest

Don't process non-package files as manifests.

--nosignature

Don't verify package or header signatures when reading.

--nodeps

Don't do a dependency check before installing or upgrading a package.

--noorder

Don't reorder the packages for an install. The list of packages would normally be reordered to satisfy dependencies.

--noscripts

--nopre

--nopost

--nopreun

--nopostun

--nopretrans

--noposttrans

Don't execute the scriptlet of the same name. The --noscripts option is equivalent to --nopre --nopost --nopreun --nopostun --nopretrans --noposttrans

and turns off the execution of the corresponding %pre, %post, %preun, %postun %pretrans, and %posttrans scriptlet(s).

--notriggers

--notriggerin

--notriggerun

--notriggerprein

--notriggerpostun

Don't execute any trigger scriptlet of the named type. The --notriggers option is equivalent to --notriggerprein --notriggerin --notriggerun --notriggerpostun

and turns off execution of the corresponding %triggerprein, %triggerin, %triggerun, and %triggerpostun scriptlet(s).

--oldpackage

Allow an upgrade to replace a newer package with an older one.

--percent

Print percentages as files are unpacked from the package archive. This is intended to make rpm easy to run from other tools.

--prefix NEWPATH

For relocatable binary packages, translate all file paths that start with the installation prefix in the package relocation hint(s) to NEWPATH.

--relocate OLDPATH=NEWPATH

For relocatable binary packages, translate all file paths that start with OLDPATH in the package relocation hint(s) to NEWPATH. This option can be used repeatedly if several OLDPATH's in the package are to be relocated.

--replacefiles

Install the packages even if they replace files from other, already installed, packages.

--replacepkgs

Install the packages even if some of them are already installed on this system.

--test

Do not install the package, simply check for and report potential conflicts.

### ERASE OPTIONS
The general form of an rpm erase command is

rpm {-e|--erase} [--allmatches] [--nodeps] [--noscripts] [--notriggers] [--test] PACKAGE_NAME ...

The following options may also be used:

--allmatches

Remove all versions of the package which match PACKAGE_NAME. Normally an error is issued if PACKAGE_NAME matches multiple packages.

--nodeps

Don't check dependencies before uninstalling the packages.

--noscripts

--nopreun

--nopostun

Don't execute the scriptlet of the same name. The --noscripts option during package erase is equivalent to --nopreun --nopostun

and turns off the execution of the corresponding %preun, and %postun scriptlet(s).

--notriggers

--notriggerun

--notriggerpostun

Don't execute any trigger scriptlet of the named type. The --notriggers option is equivalent to --notriggerun --notriggerpostun

and turns off execution of the corresponding %triggerun, and %triggerpostun scriptlet(s).

--test

Don't really uninstall anything, just go through the motions. Useful in conjunction with the -vv option for debugging.

### QUERY OPTIONS
The general form of an rpm query command is

rpm {-q|--query} [select-options] [query-options]

You may specify the format that package information should be printed in. To do this, you use the

--qf|--queryformat QUERYFMT

option, followed by the QUERYFMT format string. Query formats are modified versions of the standard printf(3) formatting. The format is made up of static strings (which may include standard C character escapes for newlines, tabs, and other special characters) and printf(3) type formatters. As rpm already knows the type to print, the type specifier must be omitted however, and replaced by the name of the header tag to be printed, enclosed by {} characters. Tag names are case insensitive, and the leading RPMTAG_ portion of the tag name may be omitted as well.

Alternate output formats may be requested by following the tag with :typetag. Currently, the following types are supported:

:armor

Wrap a public key in ASCII armor.

:arraysize

Display number of elements in array tags.

:base64

Encode binary data using base64.

:date

Use strftime(3) "%c" format.

:day

Use strftime(3) "%a %b %d %Y" format.

:depflags

Format dependency comparison operator.

:deptype

Format dependency type.

:expand

Perform macro expansion.

:fflags

Format file flags.

:fstate

Format file state.

:fstatus

Format file verify status.

:hex

Format in hexadecimal.

:octal

Format in octal.

:perms

Format file permissions.

:pgpsig

Display signature fingerprint and time.

:shescape

Escape single quotes for use in a script.

:triggertype

Display trigger suffix.

:vflags

File verification flags.

:xml

Wrap data in simple xml markup.

For example, to print only the names of the packages queried, you could use %{NAME} as the format string. To print the packages name and distribution information in two columns, you could use %-30{NAME}%{DISTRIBUTION}. rpm will print a list of all of the tags it knows about when it is invoked with the --querytags argument.

There are two subsets of options for querying: package selection, and information selection.

### PACKAGE SELECTION OPTIONS:
PACKAGE_NAME

Query installed package named PACKAGE_NAME. To specify the package more precisely the package name may be followed by the version or version and release both separated by a dash or an architecture name separated by a dot. See the output of rpm -qa or rpm -qp PACKAGE_FILE as an example.

-a, --all

Query all installed packages.

-f, --file FILE

Query package owning FILE.

-g, --group GROUP

Query packages with the group of GROUP.

--hdrid SHA1

Query package that contains a given header identifier, i.e. the SHA1 digest of the immutable header region.

-p, --package PACKAGE_FILE

Query an (uninstalled) package PACKAGE_FILE. The PACKAGE_FILE may be specified as an ftp or http style URL, in which case the package header will be downloaded and queried. See FTP/HTTP OPTIONS for information on rpm's internal ftp and http client support. The PACKAGE_FILE argument(s), if not a binary package, will be interpreted as an ASCII package manifest unless --nomanifest option is used. In manifests, comments are permitted, starting with a '#', and each line of a package manifest file may include white space separated glob expressions, including URL's, that will be expanded to paths that are substituted in place of the package manifest as additional PACKAGE_FILE arguments to the query.

--pkgid MD5

Query package that contains a given package identifier, i.e. the MD5 digest of the combined header and payload contents.

--querybynumber HDRNUM

Query the HDRNUMth database entry directly; this is useful only for debugging.

--specfile SPECFILE

Parse and query SPECFILE as if it were a package. Although not all the information (e.g. file lists) is available, this type of query permits rpm to be used to extract information from spec files without having to write a specfile parser.

--tid TID

Query package(s) that have a given TID transaction identifier. A unix time stamp is currently used as a transaction identifier. All package(s) installed or erased within a single transaction have a common identifier.

--triggeredby PACKAGE_NAME

Query packages that are triggered by package(s) PACKAGE_NAME.

--whatprovides CAPABILITY

Query all packages that provide the CAPABILITY capability.

--whatrequires CAPABILITY

Query all packages that require CAPABILITY for proper functioning.

--whatrecommends CAPABILITY

Query all packages that recommend CAPABILITY.

--whatsuggests CAPABILITY

Query all packages that suggest CAPABILITY.

--whatsupplements CAPABILITY

Query all packages that supplement CAPABILITY.

--whatenhances CAPABILITY

Query all packages that enhance CAPABILITY.

### PACKAGE QUERY OPTIONS:
--changelog

Display change information for the package.

-c, --configfiles

List only configuration files (implies -l).

--conflicts

List capabilities this package conflicts with.

-d, --docfiles

List only documentation files (implies -l).

--dump

Dump file information as follows (implies -l):

```
path size mtime digest mode owner group isconfig isdoc rdev symlink

```

--enhances

List capabilities enhanced by package(s)

--filesbypkg

List all the files in each selected package.

-i, --info

Display package information, including name, version, and description. This uses the --queryformat if one was specified.

--last

Orders the package listing by install time such that the latest packages are at the top.

-L, --licensefiles

List only license files (implies -l).

-l, --list

List files in package.

--obsoletes

List packages this package obsoletes.

--provides

List capabilities this package provides.

--recommends

List capabilities recommended by package(s)

-R, --requires

List capabilities on which this package depends.

--suggests

List capabilities suggested by package(s)

--supplements

List capabilities supplemented by package(s)

--scripts

List the package specific scriptlet(s) that are used as part of the installation and uninstallation processes.

-s, --state

Display the states of files in the package (implies -l). The state of each file is one of normal, not installed, or replaced.

--triggers, --triggerscripts

Display the trigger scripts, if any, which are contained in the package.

### VERIFY OPTIONS
The general form of an rpm verify command is

rpm {-V|--verify} [select-options] [verify-options]

Verifying a package compares information about the installed files in the package with information about the files taken from the package metadata stored in the rpm database. Among other things, verifying compares the size, digest, permissions, type, owner and group of each file. Any discrepancies are displayed. Files that were not installed from the package, for example, documentation files excluded on installation using the "--excludedocs" option, will be silently ignored.

The package selection options are the same as for package querying (including package manifest files as arguments). Other options unique to verify mode are:

--nodeps

Don't verify dependencies of packages.

--nodigest

Don't verify package or header digests when reading.

--nofiles

Don't verify any attributes of package files.

--noscripts

Don't execute the %verifyscript scriptlet (if any).

--nosignature

Don't verify package or header signatures when reading.

--nolinkto

--nofiledigest (formerly --nomd5)

--nosize

--nouser

--nogroup

--nomtime

--nomode

--nordev

Don't verify the corresponding file attribute.

The format of the output is a string of 9 characters, a possible attribute marker:

```
c %config configuration file.
d %doc documentation file.
g %ghost file (i.e. the file contents are not included in the package payload).
l %license license file.
r %readme readme file.
```

from the package header, followed by the file name. Each of the 9 characters denotes the result of a comparison of attribute(s) of the file to the value of those attribute(s) recorded in the database. A single "." (period) means the test passed, while a single "?" (question mark) indicates the test could not be performed (e.g. file permissions prevent reading). Otherwise, the (mnemonically emBoldened) character denotes failure of the corresponding --verify test:

```
S file Size differs
M Mode differs (includes permissions and file type)
5 digest (formerly MD5 sum) differs
D Device major/minor number mismatch
L readLink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs
P caPabilities differ
```

### MISCELLANEOUS COMMANDS
rpm --showrc

shows the values rpm will use for all of the options are currently set in rpmrc and macros configuration file(s).

rpm --setperms PACKAGE_NAME

sets permissions of files in the given package.

rpm --setugids PACKAGE_NAME

sets user/group ownership of files in the given package. This command can change permissions of files in that package. It is caused by calling command chmod that can clear SUID and SGID bits in some situations. So it is safer to call also --setperms after calling --setugids.

Options --setperms and --setugids are mutually exclusive.

### FTP/HTTP OPTIONS
rpm can act as an FTP and/or HTTP client so that packages can be queried or installed from the internet. Package files for install, upgrade, and query operations may be specified as an ftp or http style URL:

ftp://USER:PASSWORD@HOST:PORT/path/to/package.rpm

If the :PASSWORD portion is omitted, the password will be prompted for (once per user/hostname pair). If both the user and password are omitted, anonymous ftp is used. In all cases, passive (PASV) ftp transfers are performed.

rpm allows the following options to be used with ftp URLs:

--ftpproxy HOST

The host HOST will be used as a proxy server for all ftp transfers, which allows users to ftp through firewall machines which use proxy systems. This option may also be specified by configuring the macro %_ftpproxy.

--ftpport PORT

The TCP PORT number to use for the ftp connection on the proxy ftp server instead of the default port. This option may also be specified by configuring the macro %_ftpport.

rpm allows the following options to be used with http URLs:

--httpproxy HOST

The host HOST will be used as a proxy server for all http transfers. This option may also be specified by configuring the macro %_httpproxy.

--httpport PORT

The TCP PORT number to use for the http connection on the proxy http server instead of the default port. This option may also be specified by configuring the macro %_httpport.

## LEGACY ISSUES

### Executing rpmbuild
The build modes of rpm are now resident in the /usr/bin/rpmbuild executable. Install the package containing rpmbuild (usually rpm-build) and see rpmbuild(8) for documentation of all the rpm build modes.

## FILES

### rpmrc Configuration

```
/usr/lib/rpm/rpmrc
/usr/lib/rpm/redhat/rpmrc
/etc/rpmrc
~/.rpmrc
```

### Macro Configuration

```
/usr/lib/rpm/macros
/usr/lib/rpm/redhat/macros
/etc/rpm/macros
~/.rpmmacros
```

### Database

```
/var/lib/rpm/Basenames
/var/lib/rpm/Conflictname
/var/lib/rpm/Dirnames
/var/lib/rpm/Group
/var/lib/rpm/Installtid
/var/lib/rpm/Name
/var/lib/rpm/Obsoletename
/var/lib/rpm/Packages
/var/lib/rpm/Providename
/var/lib/rpm/Requirename
/var/lib/rpm/Sha1header
/var/lib/rpm/Sigmd5
/var/lib/rpm/Triggername
```

### Temporary
/var/tmp/rpm*

## SEE ALSO

```
popt(3),
rpm2cpio(8),
rpmbuild(8),
rpmdb(8),
rpmkeys(8),
rpmsign(8),
rpmspec(8),
```

rpm --help - as rpm supports customizing the options via popt aliases it's impossible to guarantee that what's described in the manual matches what's available.

http://www.rpm.org/ <URL:http://www.rpm.org/>

## AUTHORS

```
Marc Ewing <marc@redhat.com>
Jeff Johnson <jbj@redhat.com>
Erik Troan <ewt@redhat.com>
```


title: rpm2cpio(8)

text:
# rpm2cpio(8)

## NAME
rpm2cpio - Extract cpio archive from RPM Package Manager (RPM) package.

## SYNOPSIS
rpm2cpio [filename]

## DESCRIPTION
rpm2cpio converts the .rpm file specified as a single argument to a cpio archive on standard out. If a '-' argument is given, an rpm stream is read from standard in.

rpm2cpio rpm-1.1-1.i386.rpm

rpm2cpio - < glint-1.0-1.i386.rpm

rpm2cpio glint-1.0-1.i386.rpm | cpio -dium

## SEE ALSO
rpm(8)

## AUTHOR

```
Erik Troan <ewt@redhat.com>
```


rpmdb

title: rpmdb(8)

summary: RPM Database Tool

text:
# rpmdb(8)

## NAME
rpmdb - RPM Database Tool

## SYNOPSIS
rpm {--initdb|--rebuilddb}

## DESCRIPTION
The general form of an rpm rebuild database command is

rpm {--initdb|--rebuilddb} [-v] [--dbpath DIRECTORY] [--root DIRECTORY]

Use --initdb to create a new database if one doesn't already exist (existing database is not overwritten), use --rebuilddb to rebuild the database indices from the installed package headers.

## SEE ALSO

```
popt(3),
rpm(8),
rpmkeys(8),
rpmsign(8),
rpm2cpio(8),
rpmbuild(8),
rpmspec(8),
```

rpm --help - as rpm supports customizing the options via popt aliases it's impossible to guarantee that what's described in the manual matches what's available.

http://www.rpm.org/ <URL:http://www.rpm.org/>

## AUTHORS

```
Marc Ewing <marc@redhat.com>
Jeff Johnson <jbj@redhat.com>
Erik Troan <ewt@redhat.com>
Panu Matilainen <pmatilai@redhat.com>
```


rpmkeys

title: rpmkeys(8)

summary: RPM Keyring

text:
# rpmkeys(8)

## NAME
rpmkeys - RPM Keyring

## SYNOPSIS
rpmkeys {--import|--checksig}

## DESCRIPTION
The general forms of rpm digital signature commands are

rpmkeys --import PUBKEY ...

rpmkeys {-K|--checksig} PACKAGE_FILE ...

The --checksig option checks all the digests and signatures contained in PACKAGE_FILE to ensure the integrity and origin of the package. Note that signatures are now verified whenever a package is read, and --checksig is useful to verify all of the digests and signatures associated with a package.

Digital signatures cannot be verified without a public key. An ASCII armored public key can be added to the rpm database using --import. An imported public key is carried in a header, and key ring management is performed exactly like package management. For example, all currently imported public keys can be displayed by:

rpm -qa gpg-pubkey*

Details about a specific public key, when imported, can be displayed by querying. Here's information about the Red Hat GPG/DSA key:

rpm -qi gpg-pubkey-db42a60e

Finally, public keys can be erased after importing just like packages. Here's how to remove the Red Hat GPG/DSA key

rpm -e gpg-pubkey-db42a60e

## SEE ALSO

```
popt(3),
rpm(8),
rpmdb(8),
rpmsign(8),
rpm2cpio(8),
rpmbuild(8),
rpmspec(8),
```

rpmkeys --help - as rpm supports customizing the options via popt aliases it's impossible to guarantee that what's described in the manual matches what's available.

http://www.rpm.org/ <URL:http://www.rpm.org/>

## AUTHORS

```
Marc Ewing <marc@redhat.com>
Jeff Johnson <jbj@redhat.com>
Erik Troan <ewt@redhat.com>
Panu Matilainen <pmatilai@redhat.com>
```


rpmsign

title: rpmsign(8)

summary: RPM Package Signing

text:
# rpmsign(8)

## NAME
rpmsign - RPM Package Signing

## SYNOPSIS

### SIGNING PACKAGES:
rpm --addsign|--resign [rpmsign-options] PACKAGE_FILE ...

rpm --delsign PACKAGE_FILE ...

### rpmsign-options
[--fskpath KEY] [--signfiles]

## DESCRIPTION
Both of the --addsign and --resign options generate and insert new signatures for each package PACKAGE_FILE given, replacing any existing signatures. There are two options for historical reasons, there is no difference in behavior currently.

rpm --delsign PACKAGE_FILE ...

Delete all signatures from each package PACKAGE_FILE given.

### SIGN OPTIONS
--fskpath KEY

Used with --signfiles, use file signing key Key.

--signfiles

Sign package files. The macro %_binary_filedigest_algorithm must be set to a supported algorithm before building the package. The supported algorithms are SHA1, SHA256, SHA384, and SHA512, which are represented as 2, 8, 9, and 10 respectively. The file signing key (RSA private key) must be set before signing the package, it can be configured on the command line with --fskpath or the macro %_file_signing_key.

### USING GPG TO SIGN PACKAGES
In order to sign packages using GPG, rpm must be configured to run GPG and be able to find a key ring with the appropriate keys. By default, rpm uses the same conventions as GPG to find key rings, namely the $GNUPGHOME environment variable. If your key rings are not located where GPG expects them to be, you will need to configure the macro %_gpg_path to be the location of the GPG key rings to use. If you want to be able to sign packages you create yourself, you also need to create your own public and secret key pair (see the GPG manual). You will also need to configure the rpm macros

%_gpg_name

The name of the "user" whose key you wish to use to sign your packages.

For example, to be able to use GPG to sign packages as the user "John Doe <jdoe@foo.com>" from the key rings located in /etc/rpm/.gpg using the executable /usr/bin/gpg you would include

```
%_gpg_path /etc/rpm/.gpg
%_gpg_name John Doe <jdoe@foo.com>
%__gpg /usr/bin/gpg
```

in a macro configuration file. Use /etc/rpm/macros for per-system configuration and ~/.rpmmacros for per-user configuration. Typically it's sufficient to set just %_gpg_name.

## SEE ALSO

```
popt(3),
rpm(8),
rpmdb(8),
rpmkeys(8),
rpm2cpio(8),
rpmbuild(8),
rpmspec(8),
```

rpmsign --help - as rpm supports customizing the options via popt aliases it's impossible to guarantee that what's described in the manual matches what's available.

http://www.rpm.org/ <URL:http://www.rpm.org/>

## AUTHORS

```
Marc Ewing <marc@redhat.com>
Jeff Johnson <jbj@redhat.com>
Erik Troan <ewt@redhat.com>
Panu Matilainen <pmatilai@redhat.com>
Fionnuala Gunter <fin@linux.vnet.ibm.com>
```


rpmbuild

package: rpm-build

title: rpmbuild(8)

summary: Build RPM Package(s)

text:
# rpmbuild(8)

## NAME
rpmbuild - Build RPM Package(s)

## SYNOPSIS

### BUILDING PACKAGES:
rpmbuild {-ba|-bb|-bp|-bc|-bi|-bl|-bs|-bt} [rpmbuild-options] SPECFILE ...

rpmbuild {-ta|-tb|-tp|-tc|-ti|-tl|-ts} [rpmbuild-options] TARBALL ...

rpmbuild {--rebuild|--recompile} SOURCEPKG ...

### MISCELLANEOUS:
rpmbuild --showrc

### RPMBUILD OPTIONS:

[--buildroot DIRECTORY] [--clean] [--nobuild]

[--rmsource] [--rmspec] [--short-circuit] [--sign]

[--nosource] [--nopatch]

[--target PLATFORM]

## DESCRIPTION
rpmbuild is used to build both binary and source software packages. A package consists of an archive of files and meta-data used to install and erase the archive files. The meta-data includes helper scripts, file attributes, and descriptive information about the package. Packages come in two varieties: binary packages, used to encapsulate software to be installed, and source packages, containing the source code and recipe necessary to produce binary packages.

One of the following basic modes must be selected: Build Package, Build Package from Tarball, Recompile Package, Show Configuration.

### GENERAL OPTIONS
These options can be used in all the different modes.

-?, --help

Print a longer usage message then normal.

--version

Print a single line containing the version number of rpm being used.

--quiet

Print as little as possible - normally only error messages will be displayed.

-v

Print verbose information - normally routine progress messages will be displayed.

-vv

Print lots of ugly debugging information.

--rcfile FILELIST

Each of the files in the colon separated FILELIST is read sequentially by rpm for configuration information. Only the first file in the list must exist, and tildes will be expanded to the value of $HOME. The default FILELIST is /usr/lib/rpm/rpmrc:/etc/rpmrc:~/.rpmrc.

--pipe CMD

Pipes the output of rpm to the command CMD.

--dbpath DIRECTORY

Use the database in DIRECTORY rather than the default path /var/lib/rpm

--root DIRECTORY

Use the file system tree rooted at DIRECTORY for all operations. Note that this means the database within DIRECTORY will be used for dependency checks and any scriptlet(s) (e.g. %post if installing, or %prep if building, a package) will be run after a chroot(2) to DIRECTORY.

### BUILD OPTIONS
The general form of an rpm build command is

rpmbuild {-bSTAGE|-tSTAGE} [rpmbuild options] FILE ...

The argument used is -b if a spec file is being used to build the package and -t if rpmbuild should look inside of a (possibly compressed) tar file for the spec file to use. After the first argument, the next character (STAGE) specifies the stages of building and packaging to be done and is one of:

-ba

Build binary and source packages (after doing the %prep, %build, and %install stages).

-bb

Build a binary package (after doing the %prep, %build, and %install stages).

-bp

Executes the "%prep" stage from the spec file. Normally this involves unpacking the sources and applying any patches.

-bc

Do the "%build" stage from the spec file (after doing the %prep stage). This generally involves the equivalent of a "make".

-bi

Do "%install" and "%check" stages from the spec file (after doing the %prep and %build stages). This generally involves the equivalent of a "make install".

-bt

Do just the "%check" stage from the spec file.

-bl

Do a "list check". The "%files" section from the spec file is macro expanded, and checks are made to verify that each file exists.

-bs

Build just the source package.

The following options may also be used:

--buildroot DIRECTORY

When building a package, override the BuildRoot tag with directory DIRECTORY.

--clean

Remove the build tree after the packages are made.

--nobuild

Do not execute any build stages. Useful for testing out spec files.

--nopatch STRING

Do not include specified patches into source rpm file.

--nosource STRING

Do not include specified sources into source rpm file.

--rmsource

Remove the sources after the build (may also be used standalone, e.g. "rpmbuild --rmsource foo.spec").

--rmspec

Remove the spec file after the build (may also be used standalone, eg. "rpmbuild --rmspec foo.spec").

--short-circuit

Skip straight to specified stage (i.e., skip all stages leading up to the specified stage). Only valid with -bc and -bi.

--sign

Embed a GPG signature in the package. This signature can be used to verify the integrity and the origin of the package. See the section on GPG SIGNATURES in rpm(8) for configuration details.

--target PLATFORM

When building the package, interpret PLATFORM as arch-vendor-os and set the macros %_target, %_target_cpu, and %_target_os accordingly.

### REBUILD AND RECOMPILE OPTIONS
There are two other ways to invoke building with rpm:

rpmbuild {--rebuild|--recompile} SOURCEPKG ...

When invoked this way, rpmbuild installs the named source package, and does a prep, compile and install. In addition, --rebuild builds a new binary package. When the build has completed, the build directory is removed (as in --clean) and the the sources and spec file for the package are removed.

### SHOWRC
The command

rpmbuild --showrc

shows the values rpmbuild will use for all of the options are currently set in rpmrc and macros configuration file(s).

## FILES
/usr/lib/rpm/rpmrc

/etc/rpmrc

~/.rpmrc

/usr/lib/rpm/macros

/etc/rpm/macros

~/.rpmmacros

/var/lib/rpm/Conflictname

/var/lib/rpm/Basenames

/var/lib/rpm/Group

/var/lib/rpm/Name

/var/lib/rpm/Packages

/var/lib/rpm/Providename

/var/lib/rpm/Requirename

/var/lib/rpm/Triggername

/var/tmp/rpm*

## SEE ALSO
popt(3),

rpm2cpio(8),

gendiff(1),

rpminit(1),

rpm(8),

http://www.rpm.org/ <URL:http://www.rpm.org/>

## AUTHORS
Marc Ewing <marc@redhat.com>

Jeff Johnson <jbj@redhat.com>

Erik Troan <ewt@redhat.com>


rpmdev-rmdevelrpms

package: rpmdevtools

title: rpmdev-rmdevelrpms(8)

text:
# rpmdev-rmdevelrpms(8)

## NAME
rpmdev-rmdevelrpms - manual page for rpmdev-rmdevelrpms version 1.15

## SYNOPSIS
rpmdev-rmdevelrpms [options]

## DESCRIPTION
rpmdev-rmdevelrpms is a script for finding and optionally removing "development" packages, for example for cleanup purposes before starting to build a new package.

By default, the following packages are treated as development ones and are thus candidates for removal: any package whose name matches "-devel\b", "-debuginfo\b", "-sdk\b", or "-static\b" (case insensitively) except gcc requirements; any package whose name starts with "perl-(Devel|ExtUtils|Test)-"; any package whose name starts with "compat-gcc"; packages in the internal list of known development oriented packages (see def_devpkgs in the source code); packages determined to be development ones based on some basic heuristic checks on the package's contents.

The default set of packages above is not intended to not reduce a system into a minimal clean build root, but to keep it usable for general purposes while getting rid of a reasonably large set of development packages. The package set operated on can be configured to meet various scenarios.

To include additional packages in the list of ones treated as development packages, use the "devpkgs" option in the configuration file. To exclude packages from the list use "nondevpkgs" in it. Exclusion overrides inclusion.

The system wide configuration file is /etc/rpmdevtools/rmdevelrpms.conf, and per user settings (which override system ones) can be specified in ~/.config/rpmdevtools/rmdevelrpms.conf or ~/.rmdevelrpmsrc (deprecated). These files are written in Python.

## OPTIONS
-h, --help

show this help message and exit

-l, --list-only

Output condensed list of packages, do not remove.

--qf=QF, --queryformat=QF

Query format to use for output.

-y, --yes

Root only: remove without prompting; ignored with -l.

-v, --version

Print program version and exit.

## REPORTING BUGS
Report bugs to <http://bugzilla.redhat.com/>.

## COPYRIGHT
Copyright © 2004-2014 Ville Skytt?? <ville.skytta@iki.fi> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.


rpmspec

package: rpmspec

title: rpmspec(8)

summary: RPM Spec Tool

text:
# rpmspec(8)

## NAME
rpmspec - RPM Spec Tool

## SYNOPSIS

### QUERYING SPEC FILES:
rpmspec {-q|--query} [select-options] [query-options] SPEC_FILE ...

### select-options

[--rpms]

[--srpm]

### query-options

[--qf,--queryformat QUERYFMT]

[--target TARGET_PLATFORM]

### QUERY OPTIONS
The general form of an rpm spec query command is

rpm {-q|--query} [select-options] [query-options]

You may specify the format that the information should be printed in. To do this, you use the

--qf|--queryformat QUERYFMT

option, followed by the QUERYFMT format string. See rpm(8) for details.

### SELECT OPTIONS

--rpms Operate on the binary package header(s).

--srpm Operate on the source package header(s).

## SEE ALSO

```
popt(3),
rpm(8),
rpmdb(8),
rpmkeys(8),
rpmsign(8),
rpm2cpio(8),
rpmbuild(8),
```

rpmspec --help - as rpm supports customizing the options via popt aliases it's impossible to guarantee that what's described in the manual matches what's available.

http://www.rpm.org/ <URL:http://www.rpm.org/>

## AUTHORS

```
Marc Ewing <marc@redhat.com>
Jeff Johnson <jbj@redhat.com>
Erik Troan <ewt@redhat.com>
Panu Matilainen <pmatilai@redhat.com>
```


in.rexecd

package: rsh-server

title: in.rexecd(8)

summary: remote execution server

text:
# in.rexecd(8)

## NAME
rexecd — remote execution server

## SYNOPSIS
rexecd

[ -D ]

## OPTIONS
Rexec accepts one option:

-D

Disable reverse DNS look up and in the log will be used client IP addresses.

## DESCRIPTION
Rexecd is the server for the rexec(3) routine. The server provides remote execution facilities with authentication based on user names and passwords.

Rexecd listens for service requests at the port indicated in the ``exec'' service specification; see services(5). When a service request is received the following protocol is initiated:

- The server reads characters from the socket up to a NUL (‘\0’) byte. The resultant string is interpreted as an ASCII number, base 10.

- If the number received in step 1 is non-zero, it is interpreted as the port number of a secondary stream to be used for the stderr. A second connection will be created to the specified port on the client's machine after receiving and authenticating the user, password, and command from the client.

- A NUL terminated user name of at most 16 characters is retrieved on the initial socket.

- A NUL terminated, unencrypted password of at most 16 characters is retrieved on the initial socket.

- A NUL terminated command to be passed to a shell is retrieved on the initial socket. The length of the command is limited by the upper bound on the size of the system's argument list.

- Rexecd then validates the user as is done at login time and, if the authentication was successful, changes to the user's home directory, and establishes the user and group protections of the user. If any of these steps fail the connection is aborted with a diagnostic message returned.

- A NUL byte is returned on the initial socket and the command line is passed to the normal login shell of the user. The shell inherits the network connections established by rexecd.

## DIAGNOSTICS
Except for the last one listed below, all diagnostic messages are returned on the initial socket, after which any network connections are closed. An error is indicated by a leading byte with a value of 1 (0 is returned in step 7 above upon successful completion of all the steps prior to the command execution).

username too long

The name is longer than 16 characters.

password too long

The password is longer than 16 characters.

command too long

The command line passed exceeds the size of the argument list (as configured into the system).

Login incorrect.

No password file entry for the user name existed or the wrong password was supplied.

No remote directory.

The chdir command to the home directory failed.

Try again.

A fork by the server failed.

<shellname>: ...

The user's login shell could not be started. This message is returned on the connection associated with the stderr, and is not preceded by a flag byte.

## SEE ALSO
rexec(3)

## BUGS
A facility to allow all data and password exchanges to be encrypted should be present.

## HISTORY
The rexecd command appeared in 4.2BSD.


in.rlogind

title: in.rlogind(8)

summary: remote login server

text:
# in.rlogind(8)

## NAME
rlogind — remote login server

## SYNOPSIS
rlogind

[-ahlLn]

## DESCRIPTION
Rlogind is the server for the rlogin(1) program. The server provides a remote login facility with authentication based on privileged port numbers from trusted hosts.

Options supported by rlogind:

-a

Ask hostname for verification.

-h

Permit use of superuser “.rhosts” files.

-l

Prevent any authentication based on the user's “.rhosts” file. If the user is logging in as the superuser and the -h option is used, “.rhosts” processing is still enabled.

-L

Prevent any authentication based on “.rhosts” or “hosts.equiv” information.

-n

Disable keep-alive messages.

The -h, -l, and -L flags are not used if PAM (Pluggable Authentication Module) support is in use. In this case the same effects can be achieved by editing /etc/pam.conf.

The -h and -l options should also not be trusted without verifying that they work as expected with the particular version of libc installed on your system (and should be tested again after any libc update) because some versions of libc may not honor the internal flags used by rlogind. As the -L option bypasses the libc functions entirely, it is not subject to this problem.

Also note that the design of the .rhosts system is COMPLETELY INSECURE except on a carefully firewalled private network. Always use the -L option under all other circumstances. Also, since rlogind does not encrypt communications, it should not, in general, be used at all. Consider ssh(8).

Rlogind listens for service requests at the port indicated in the ``login'' service specification; see services(5). When a service request is received the following protocol is initiated:

- The server checks the client's source port. If the port is not in the range 512-1023, the server aborts the connection.

- The server checks the client's source address and requests the corresponding host name (see gethostbyaddr(3), hosts(5) and named(8)). If the hostname cannot be determined, the dot-notation representation of the host address is used. If the hostname is in the same domain as the server (according to the last two components of the domain name), or if the -a option is given, the addresses for the hostname are requested, verifying that the name and address correspond. Normal authentication is bypassed if the address verification fails.

Once the source port and address have been checked, rlogind proceeds with the authentication process described in rshd(8). It then allocates a pseudo terminal (see pty(4)), and manipulates file descriptors so that the slave half of the pseudo terminal becomes the stdin, stdout, and stderr for a login process. The login process is an instance of the login(1) program, invoked with the -f option if authentication has succeeded. If automatic authentication fails, the user is prompted to log in as if on a standard terminal line.

The parent of the login process manipulates the master side of the pseudo terminal, operating as an intermediary between the login process and the client instance of the rlogin program. In normal operation, the packet protocol described in pty(4) is invoked to provide ‘^S/^Q’ type facilities and propagate interrupt signals to the remote programs. The login process propagates the client terminal's baud rate and terminal type, as found in the environment variable, ‘TERM’; see environ(7). The screen or window size of the terminal is requested from the client, and window size changes from the client are propagated to the pseudo terminal.

Transport-level keepalive messages are enabled unless the -n option is present. The use of keepalive messages allows sessions to be timed out if the client crashes or becomes unreachable.

## DIAGNOSTICS
All initial diagnostic messages are indicated by a leading byte with a value of 1, after which any network connections are closed. If there are no errors before login is invoked, a null byte is returned as in indication of success.

Try again.

A fork by the server failed.

## SEE ALSO
login(1), ruserok(3), rshd(8)

## BUGS
The authentication procedure used here assumes the integrity of each client machine and the connecting medium. This is insecure, but is useful in an ``open'' environment.

A facility to allow all data exchanges to be encrypted should be present.

A more extensible protocol should be used.

## HISTORY
The rlogind command appeared in 4.2BSD.


in.rshd

title: in.rshd(8)

summary: remote shell server

text:
# in.rshd(8)

## NAME
rshd — remote shell server

## SYNOPSIS
rshd

[-ahlnL]

## DESCRIPTION
The rshd server is the server for the rcmd(3) routine and, consequently, for the rsh(1) program. The server provides remote execution facilities with authentication based on privileged port numbers from trusted hosts.

The rshd server listens for service requests at the port indicated in the ``cmd'' service specification; see services(5). When a service request is received the following protocol is initiated:

- The server checks the client's source port. If the port is not in the range 512-1023, the server aborts the connection.

- The server reads characters from the socket up to a null (`\0') byte. The resultant string is interpreted as an ASCII number, base 10.

- If the number received in step 2 is non-zero, it is interpreted as the port number of a secondary stream to be used for the stderr. A second connection is then created to the specified port on the client's machine. The source port of this second connection is also in the range 512-1023.

- The server checks the client's source address and requests the corresponding host name (see gethostbyaddr(3), hosts(5) and named(8)). If the hostname cannot be determined, the dot-notation representation of the host address is used. If the hostname is in the same domain as the server (according to the last two components of the domain name), or if the -a option is given, the addresses for the hostname are requested, verifying that the name and address correspond. If address verification fails, the connection is aborted with the message, ``Host address mismatch.''

- A null terminated user name of at most 16 characters is retrieved on the initial socket. This user name is interpreted as the user identity on the client's machine.

- A null terminated user name of at most 16 characters is retrieved on the initial socket. This user name is interpreted as a user identity to use on the server's machine.

- A null terminated command to be passed to a shell is retrieved on the initial socket. The length of the command is limited by the upper bound on the size of the system's argument list.

- Rshd then validates the user using ruserok(3), which uses the file /etc/hosts.equiv and the .rhosts file found in the user's home directory. The -l option prevents ruserok(3) from doing any validation based on the user's ``.rhosts'' file (unless the user is the superuser and the -h option is used.) If the -h option is not used, superuser accounts may not be accessed via this service at all. The -l option should not be trusted without verifying that it works as expected with the particular version of libc installed on your system (and should be tested again after any libc update) because some versions of libc may not honor the flags used by rshd.

Also note that the design of the .rhosts system is COMPLETELY INSECURE except on a carefully firewalled private network. Under all other circumstances, rshd should be disabled entirely.

- A null byte is returned on the initial socket and the command line is passed to the normal login shell of the user. The shell inherits the network connections established by rshd.

Transport-level keepalive messages are enabled unless the -n option is present. The use of keepalive messages allows sessions to be timed out if the client crashes or becomes unreachable.

The -L option causes all successful accesses to be logged to syslogd(8) as auth.info messages and all failed accesses to be logged as auth.notice.

## DIAGNOSTICS
Except for the last one listed below, all diagnostic messages are returned on the initial socket, after which any network connections are closed. An error is indicated by a leading byte with a value of 1 (0 is returned in step 9 above upon successful completion of all the steps prior to the execution of the login shell).

Locuser too long.

The name of the user on the client's machine is longer than 16 characters.

Ruser too long.

The name of the user on the remote machine is longer than 16 characters.

Command too long.

The command line passed exceeds the size of the argument list (as configured into the system).

Remote directory.

The chdir command to the home directory failed.

Permission denied.

The authentication procedure described above failed, or the user requested did not exist. (These conditions are intentionally conflated.)

Can't make pipe.

The pipe needed for the stderr, wasn't created.

Can't fork; try again.

A fork by the server failed.

<shellname>: ...

The user's login shell could not be started. This message is returned on the connection associated with the stderr, and is not preceded by a flag byte.

## SEE ALSO
rsh(1), rcmd(3), ruserok(3)

## BUGS
The authentication procedure used here assumes the integrity of each client machine and the connecting medium. This is insecure, but is useful in an ``open'' environment.

A facility to allow all data exchanges to be encrypted should be present.

A more extensible protocol (such as Telnet) should be used.


rspamd

package: rspamd

title: rspamd(8)

text:
# rspamd(8)

## NAME
rspamd - main daemon for rapid spam filtering system

## SYNOPSIS
rspamd [options]...

rspamd --help

## DESCRIPTION
Rspamd filtering system is designed to be fast, modular and easily scalable system. Rspamd core is written in C language using event driven processing model. Plugins for rspamd can be written in Lua programming language. Rspamd is designed to process connections completely asynchronous and do not block anywhere in code.

## OPTIONS
-f, --no-fork

Do not daemonize main process

-c path, --config=path

Specify config file(s)

-u username, --user=username

User to run rspamd as

-g groupname, --group=groupname

Group to run rspamd as

-p path, --pid=path

Path to pidfile

-i, --insecure

Ignore running workers as privileged users (insecure)

## EXAMPLES
Run rspamd daemon with default configuration:

```
rspamd
```

Run rspamd in foreground with custom configuration:

```
rspamd -f -c ~/rspamd.conf
```

Run rspamd specifying user and group:

```
rspamd -u rspamd -g rspamd -c /etc/rspamd/rspamd.conf
```

## SEE ALSO
Rspamd documentation and source codes may be downloaded from <https://rspamd.com/>.


rsyslogd

package: rsyslog

title: rsyslogd(8)

summary: reliable and extended syslogd

text:
# rsyslogd(8)

## NAME
rsyslogd - reliable and extended syslogd

## SYNOPSIS
rsyslogd [ -d ] [ -D ] [ -f config file ] [ -i pid file ] [ -n ] [ -N level ] [ -o fullconf ] [ -C ] [ -v ]

## DESCRIPTION
Rsyslogd is a system utility providing support for message logging. Support of both internet and unix domain sockets enables this utility to support both local and remote logging.

Note that this version of rsyslog ships with extensive documentation in HTML format. This is provided in the ./doc subdirectory and probably in a separate package if you installed rsyslog via a packaging system. To use rsyslog's advanced features, you need to look at the HTML documentation, because the man pages only covers basic aspects of operation. For details and configuration examples, see the rsyslog.conf (5) man page and the online documentation at https://www.rsyslog.com/doc/

Rsyslogd(8) is derived from the sysklogd package which in turn is derived from the stock BSD sources.

Rsyslogd provides a kind of logging that many modern programs use. Every logged message contains at least a time and a hostname field, normally a program name field, too, but that depends on how trusty the logging program is. The rsyslog package supports free definition of output formats via templates. It also supports precise timestamps and writing directly to databases. If the database option is used, tools like phpLogCon can be used to view the log data.

While the rsyslogd sources have been heavily modified a couple of notes are in order. First of all there has been a systematic attempt to ensure that rsyslogd follows its default, standard BSD behavior. Of course, some configuration file changes are necessary in order to support the template system. However, rsyslogd should be able to use a standard syslog.conf and act like the original syslogd. However, an original syslogd will not work correctly with a rsyslog-enhanced configuration file. At best, it will generate funny looking file names. The second important concept to note is that this version of rsyslogd interacts transparently with the version of syslog found in the standard libraries. If a binary linked to the standard shared libraries fails to function correctly we would like an example of the anomalous behavior.

The main configuration file /etc/rsyslog.conf or an alternative file, given with the -f option, is read at startup. Any lines that begin with the hash mark (``#'') and empty lines are ignored. If an error occurs during parsing the error element is ignored. It is tried to parse the rest of the line.

## OPTIONS
-D

Runs the Bison config parser in debug mode. This may help when hard to find syntax errors are reported. Please note that the output generated is deeply technical and originally targeted towards developers.

-d

Turns on debug mode. See the DEBUGGING section for more information.

-f config file

Specify an alternative configuration file instead of /etc/rsyslog.conf, which is the default.

-i pid file

Specify an alternative pid file instead of the default one. This option must be used if multiple instances of rsyslogd should run on a single machine. To disable writing a pid file, use the reserved name "NONE" (all upper case!), so "-iNONE".

-n

Avoid auto-backgrounding. This is needed especially if the rsyslogd is started and controlled by init(8).

-N level

Do a config check. Do NOT run in regular mode, just check configuration file correctness. This option is meant to verify a config file. To do so, run rsyslogd interactively in foreground, specifying -f <config-file> and -N level. The level argument modifies behaviour. Currently, 0 is the same as not specifying the -N option at all (so this makes limited sense) and 1 actually activates the code. Later, higher levels will mean more verbosity (this is a forward-compatibility option).

-o fullconf

Generates a consolidated config file fullconf that contains all of rsyslog's configuration in a single file. Include files are exploded into that file in exactly the way rsyslog sees them. This option is useful for troubleshooting, especially if problems with the order of action processing is suspected. It may also be used to check for "unexepectedly" included config content.

-C

This prevents rsyslogd from changing to the root directory. This is almost never a good idea in production use. This option was introduced in support of the internal testbed.

-v

Print version and exit.

## SIGNALS
Rsyslogd reacts to a set of signals. You may easily send a signal to rsyslogd using the following:

```
kill -SIGNAL $(cat /var/run/rsyslogd.pid)
```

Note that -SIGNAL must be replaced with the actual signal you are trying to send, e.g. with HUP. So it then becomes:

```
kill -HUP $(cat /var/run/rsyslogd.pid)
```

HUP

This lets rsyslogd perform close all open files.

TERM , INT , QUIT

Rsyslogd will die.

USR1

Switch debugging on/off. This option can only be used if rsyslogd is started with the -d debug option.

CHLD

Wait for children if some were born, because of wall'ing messages.

## SECURITY THREATS
There is the potential for the rsyslogd daemon to be used as a conduit for a denial of service attack. A rogue program(mer) could very easily flood the rsyslogd daemon with syslog messages resulting in the log files consuming all the remaining space on the filesystem. Activating logging over the inet domain sockets will of course expose a system to risks outside of programs or individuals on the local machine.

There are a number of methods of protecting a machine:

1.

Implement kernel firewalling to limit which hosts or networks have access to the 514/UDP socket.

2.

Logging can be directed to an isolated or non-root filesystem which, if filled, will not impair the machine.

3.

The ext2 filesystem can be used which can be configured to limit a certain percentage of a filesystem to usage by root only. NOTE that this will require rsyslogd to be run as a non-root process. ALSO NOTE that this will prevent usage of remote logging on the default port since rsyslogd will be unable to bind to the 514/UDP socket.

4.

Disabling inet domain sockets will limit risk to the local machine.

### Message replay and spoofing
If remote logging is enabled, messages can easily be spoofed and replayed. As the messages are transmitted in clear-text, an attacker might use the information obtained from the packets for malicious things. Also, an attacker might replay recorded messages or spoof a sender's IP address, which could lead to a wrong perception of system activity. These can be prevented by using GSS-API authentication and encryption. Be sure to think about syslog network security before enabling it.

## DEBUGGING
When debugging is turned on using the -d option, rsyslogd produces debugging information according to the RSYSLOG_DEBUG environment variable and the signals received. When run in foreground, the information is written to stdout. An additional output file can be specified using the RSYSLOG_DEBUGLOG environment variable.

## FILES
/etc/rsyslog.conf

Configuration file for rsyslogd. See rsyslog.conf(5) for exact information.

/dev/log

The Unix domain socket to from where local syslog messages are read.

/var/run/rsyslogd.pid

The file containing the process id of rsyslogd.

prefix/lib/rsyslog

Default directory for rsyslogd modules. The prefix is specified during compilation (e.g. /usr/local).

## ENVIRONMENT
RSYSLOG_DEBUG

Controls runtime debug support. It contains an option string with the following options possible (all are case insensitive):

Debug

Turns on debugging and prevents forking. This is processed earlier in the startup than command line options (i.e. -d) and as such enables earlier debugging output. Mutually exclusive with DebugOnDemand.

DebugOnDemand

Enables debugging but turns off debug output. The output can be toggled by sending SIGUSR1. Mutually exclusive with Debug.

LogFuncFlow

Print out the logical flow of functions (entering and exiting them)

FileTrace

Specifies which files to trace LogFuncFlow. If not set (the default), a LogFuncFlow trace is provided for all files. Set to limit it to the files specified.FileTrace may be specified multiple times, one file each (e.g. export RSYSLOG_DEBUG="LogFuncFlow FileTrace=vm.c FileTrace=expr.c"

PrintFuncDB

Print the content of the debug function database whenever debug information is printed (e.g. abort case)!

PrintAllDebugInfoOnExit

Print all debug information immediately before rsyslogd exits (currently not implemented!)

PrintMutexAction

Print mutex action as it happens. Useful for finding deadlocks and such.

NoLogTimeStamp

Do not prefix log lines with a timestamp (default is to do that).

NoStdOut

Do not emit debug messages to stdout. If RSYSLOG_DEBUGLOG is not set, this means no messages will be displayed at all.

Help

Display a very short list of commands - hopefully a life saver if you can't access the documentation...

RSYSLOG_DEBUGLOG

If set, writes (almost) all debug message to the specified log file in addition to stdout.

RSYSLOG_MODDIR

Provides the default directory in which loadable modules reside.

## BUGS
Please review the file BUGS for up-to-date information on known bugs and annoyances.

## Further Information
Please visit https://www.rsyslog.com/doc/ for additional information, tutorials and a support forum.

## SEE ALSO
rsyslog.conf(5), logger(1), syslog(2), syslog(3), services(5), savelog(8)

## COLLABORATORS
rsyslogd is derived from sysklogd sources, which in turn was taken from the BSD sources. Special thanks to Greg Wettstein (greg@wind.enjellic.com) and Martin Schulze (joey@linux.de) for the fine sysklogd package.

Rainer Gerhards

Adiscon GmbH

Grossrinderfeld, Germany

rgerhards@adiscon.com


rteval

package: rteval

title: rteval(8)

text:
# rteval(8)

## NAME
rteval - evaluate latency performance of a realtime Linux system

## SYNOPSIS
rteval [ -hvsLSDOZ ] [-d duration ] [-w workdir ] [-l loaddir ] [-X host ]

The rteval program is used to evaluate the realtime performance of a realtime Linux kernel on a particular hardware system. There is nothing that actually requires a realtime Linux kernel, but the latency measurements will usually be pretty bad on a stock Linux kernel.

## OPTIONS
These programs follow the usual GNU command line syntax, with long options starting with two dashes ('--').

A summary of options is included below.

-h, --help

print a help message

-d, --duration=DURATION

Specify the length of the measurement run. DURATION is an integer with an optional suffix indicating the units:

s - seconds

m - minutes

h - hours

d - days

for example to execute a ten minute run of rteval:

$ rteval --duration=10m

-v, --verbose

Increase the verbosity of output during the test run

-w WORKDIR, --workdir=WORKDIR

Tell rteval to change directory to WORKDIR before creating any subdirectories for report files. The default WORKDIR is the directory in which rteval was started.

-l LOADDIR, --loaddir=LOADDIR

Tell rteval where to find the source for the loads

--loads-cpulist=CPULIST

List of CPUs where loads will run

--measurement-cpulist=CPULIST

List of CPUs where measurement applciation will run

-s, --sysreport

Have rteval run the sysreport utility after a run to gather information on the running system.

-D, --debug

Turn on debugging prints during run

-X HOST, --xmprpc-submit=HOST

Have rteval send report data to HOST following the run, using XML-RPC

-P, --xmlrpc-no-abort

Do not abort if XML-RPC server do not respond to ping request

-Z, --summarize

Have rteval summarize an existing report. This will not cause loads or meausurement utilities to be run.

-H, --raw-histogram

Generate raw histogram data for an already existing XML report

-f INIFILE, --inifile=INIFILE

Initialization file for configuring loads and behavior

-a COMMENT, --annotate=COMMENT

Add a little annotation which is stored in the report

-L, --logging

Log the output of the loads in the report directory

-O, --onlyload

Only run the loads (don't run measurement threads)

## MODULE OPTIONS
These are options that affect the execution behavior of the measurement and load modules.

--cyclictest-priority=PRIORITY

SCHED_FIFO priority for measurement threads (default: 95)

--cyclictest-interval=INTERVAL

Measurement thread interval in microseconds (default: 100)

--cyclictest-distance=DISTANCE

Interval increment in microseconds (default: 0)

--cyclictest-buckets=NBUCKETS

Number of 1 microsecond histogram buckets (default: 2000)

--hackbench-jobspercore=N

Number of jobs per online-core for hackbench load

--kcompile-jobspercore=N

Number of jobs per online-core for kernel compile load

## FILES
rteval-YYYYMMDD-S This is a directory created by rteval to hold the summary.xml file as well as other files collected on the system. It is the current Year, Month, and Day, followed by a sequence number for multiple runs on the same day.

summary.xml This is an XML file that contains information about a test run and the host system upon which rteval was run. dmesg This is the output of the dmesg(1) program immediately following system boot. It is copied from /var/log/dmesg.

## SEE ALSO
cyclictest(8).

## AUTHOR
rteval was written by Clark Williams <williams@redhat.com>

XML-RPC and database code by David Sommerseth <davids@redhat.com>


rtkitctl

package: rtkit

title: rtkitctl(8)

text:
# rtkitctl(8)

## NAME
rtkitctl - Realtime Policy and Watchdog daemon control

## SYNOPSIS
rtkitctl [options]

## DESCRIPTION
RealtimeKit is a D-Bus system service that changes the scheduling policy of user processes/threads to SCHED_RR (i.e. realtime scheduling mode) on request. It is intended to be used as a secure mechanism to allow real-time scheduling to be used by normal user processes.

## OPTIONS
-h, --help

Show a summary of options.

--version

Show version.

--reset-known

Reset real-time status of known threads.

--reset-all

Reset real-time status of all threads.

--start

Start RealtimeKit if it is not running already.

-k, --exit

Terminate running RealtimeKit daemon.

## AUTHOR
RealtimeKit was written by Lennart Poettering <lennart@poettering.net>.


runc

package: runc

title: runc(8)

summary: Open Container Initiative runtime

text:
# runc(8)

## NAME
runc - Open Container Initiative runtime

## SYNOPSIS
runc [global-option ...] command [command-option ...] [argument ...]

## DESCRIPTION
runc is a command line client for running applications packaged according to the Open Container Initiative (OCI) format and is a compliant implementation of the Open Container Initiative specification.

runc integrates well with existing process supervisors to provide a production container runtime environment for applications. It can be used with your existing process monitoring tools and the container will be spawned as a direct child of the process supervisor.

Containers are configured using bundles. A bundle for a container is a directory that includes a specification file named config.json and a root filesystem. The root filesystem contains the contents of the container.

To run a new instance of a container:

```
# runc run [ -b bundle ] container-id
```

Where container-id is your name for the instance of the container that you are starting. The name you provide for the container instance must be unique on your host.

Providing the bundle directory using -b is optional. The default value for bundle is the current directory.

## COMMANDS
checkpoint : Checkpoint a running container. See runc-checkpoint(8).

create : Create a container. See runc-create(8).

delete : Delete any resources held by the container; often used with detached containers. See runc-delete(8).

events : Display container events, such as OOM notifications, CPU, memory, I/O and network statistics. See runc-events(8).

exec : Execute a new process inside the container. See runc-exec(8).

kill : Send a specified signal to the container's init process. See runc-kill(8).

list : List containers started by runc with the given --root. See runc-list(8).

pause : Suspend all processes inside the container. See runc-pause(8).

ps : Show processes running inside the container. See runc-ps(8).

restore : Restore a container from a previous checkpoint. See runc-restore(8).

resume : Resume all processes that have been previously paused. See runc-resume(8).

run : Create and start a container. See runc-run(8).

spec : Create a new specification file (config.json). See runc-spec(8).

start : Start a container previously created by runc create. See runc-start(8).

state : Show the container state. See runc-state(8).

update : Update container resource constraints. See runc-update(8).

help, h : Show a list of commands or help for a particular command.

## GLOBAL OPTIONS
These options can be used with any command, and must precede the command.

--debug : Enable debug logging.

--log path : Set the log destination to path. The default is to log to stderr.

--log-format text|json : Set the log format (default is text).

--root path : Set the root directory to store containers' state. The path should be located on tmpfs. Default is /run/runc, or $XDG_RUNTIME_DIR/runc for rootless containers.

--systemd-cgroup : Enable systemd cgroup support. If this is set, the container spec (config.json) is expected to have cgroupsPath value in the slice:prefix:name form (e.g. system.slice:runc:434234).

--rootless true|false|auto : Enable or disable rootless mode. Default is auto, meaning to auto-detect whether rootless should be enabled.

--help|-h : Show help.

--version|-v : Show version.

## SEE ALSO
runc-checkpoint(8), runc-create(8), runc-delete(8), runc-events(8), runc-exec(8), runc-kill(8), runc-list(8), runc-pause(8), runc-ps(8), runc-restore(8), runc-resume(8), runc-run(8), runc-spec(8), runc-start(8), runc-state(8), runc-update(8).


runc-checkpoint

title: runc-checkpoint(8)

summary: checkpoint a running container

text:
# runc-checkpoint(8)

## NAME
runc-checkpoint - checkpoint a running container

## SYNOPSIS
runc checkpoint [option ...] container-id

## DESCRIPTION
The checkpoint command saves the state of the running container instance with the help of criu(8) tool, to be restored later.

## OPTIONS
--image-path path : Set path for saving criu image files. The default is ./checkpoint.

--work-path path : Set path for saving criu work files and logs. The default is to reuse the image files directory.

--parent-path path : Set path for previous criu image files, in pre-dump.

--leave-running : Leave the process running after checkpointing.

--tcp-established : Allow checkpoint/restore of established TCP connections. See criu --tcp-establised option ⟨https://criu.org/CLI/opt/--tcp-established⟩.

--tcp-skip-in-flight : Skip in-flight TCP connections. See criu --skip-in-flight option ⟨https://criu.org/CLI/opt/--skip-in-flight⟩.

--link-remap : Allow one to link unlinked files back when possible. See criu --link-remap option ⟨https://criu.org/CLI/opt/--link-remap⟩.

--ext-unix-sk : Allow checkpoint/restore of external unix sockets. See criu --ext-unix-sk option ⟨https://criu.org/CLI/opt/--ext-unix-sk⟩.

--shell-job : Allow checkpoint/restore of shell jobs.

--lazy-pages : Use lazy migration mechanism. See criu --lazy-pages option ⟨https://criu.org/CLI/opt/--lazy-pages⟩.

--status-fd fd : Pass a file descriptor fd to criu. Once lazy-pages server is ready, criu writes \0 (a zero byte) to that fd. Used together with --lazy-pages.

--page-server IP-address:port : Start a page server at the specified IP-address and port. This is used together with criu lazy-pages. See criu lazy migration ⟨https://criu.org/Lazy_migration⟩.

--file-locks : Allow checkpoint/restore of file locks. See criu --file-locks option ⟨https://criu.org/CLI/opt/--file-locks⟩.

--pre-dump : Do a pre-dump, i.e. dump container's memory information only, leaving the container running. See criu iterative migration ⟨https://criu.org/Iterative_migration⟩.

--manage-cgroups-mode soft|full|strict|ignore. : Cgroups mode. Default is soft. See criu --manage-cgroups option ⟨https://criu.org/CLI/opt/--manage-cgroups⟩.

--empty-ns namespace : Checkpoint a namespace, but don't save its properties. See criu --empty-ns option ⟨https://criu.org/CLI/opt/--empty-ns⟩.

--auto-dedup : Enable auto deduplication of memory images. See criu --auto-dedup option ⟨https://criu.org/CLI/opt/--auto-dedup⟩.

## SEE ALSO
criu(8), runc-restore(8), runc(8), criu(8).


runc-create

title: runc-create(8)

summary: create a container

text:
# runc-create(8)

## NAME
runc-create - create a container

## SYNOPSIS
runc create [option ...] container-id

## DESCRIPTION
The create command creates an instance of a container from a bundle. The bundle is a directory with a specification file named config.json, and a root filesystem.

## OPTIONS
--bundle|-b path : Path to the root of the bundle directory. Default is current directory.

--console-socket path : Path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal. See docs/terminals ⟨https://github.com/opencontainers/runc/blob/master/docs/terminals.md⟩.

--pid-file path : Specify the file to write the initial container process' PID to.

--no-pivot : Do not use pivot root to jail process inside rootfs. This should not be used except in exceptional circumstances, and may be unsafe from the security standpoint.

--no-new-keyring : Do not create a new session keyring for the container. This will cause the container to inherit the calling processes session key.

--preserve-fds N : Pass N additional file descriptors to the container (stdio + $LISTEN_FDS + N in total). Default is 0.

## SEE ALSO
runc-spec(8), runc-start(8), runc(8).


runc-delete

title: runc-delete(8)

text:
# runc-delete(8)

## NAME
runc-delete - delete any resources held by the container

## SYNOPSIS
runc delete [--force|-f] container-id

## OPTIONS
--force|-f : Forcibly delete the running container, using SIGKILL signal(7) to stop it first.

## EXAMPLES
If the container id is ubuntu01 and runc list currently shows its status as stopped, the following will delete resources held for ubuntu01, removing it from the runc list:

```
# runc delete ubuntu01
```

## SEE ALSO
runc-kill(8), runc(8).


runc-events

title: runc-events(8)

text:
# runc-events(8)

## NAME
runc-events - display container events and statistics.

## SYNOPSIS
runc events [option ...] container-id

## DESCRIPTION
The events command displays information about the container. By default, it works continuously, displaying stats every 5 seconds, and container events as they occur.

## OPTIONS
--interval time : Set the stats collection interval. Default is 5s.

--stats : Show the container's stats once then exit.

## SEE ALSO
runc(8).


runc-exec

title: runc-exec(8)

text:
# runc-exec(8)

## NAME
runc-exec - execute new process inside the container

## SYNOPSIS
runc exec [option ...] container-id [--] command [arg ...]

runc exec [option ...] -p process.json container-id

## OPTIONS
--console-socket path : Path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal. See docs/terminals ⟨https://github.com/opencontainers/runc/blob/master/docs/terminals.md⟩.

--cwd path : Change to path in the container before executing the command.

--env|-e name=value : Set an environment variable name to value. Can be specified multiple times.

--tty|-t : Allocate a pseudo-TTY.

--user|-u uid[:gid] : Run the command as a user (and, optionally, group) specified by uid (and gid).

--additional-gids|-g gid : Add additional group IDs. Can be specified multiple times.

--process|-p process.json : Instead of specifying all the exec parameters directly on the command line, get them from a process.json, a JSON file containing the process specification as defined by the OCI runtime spec ⟨https://github.com/opencontainers/runtime-spec/blob/master/config.md#process⟩.

--detach|-d : Detach from the container's process.

--pid-file path : Specify the file to write the container process' PID to.

--process-label label : Set the asm process label for the process commonly used with selinux(7).

--apparmor profile : Set the apparmor(7) profile for the process.

--no-new-privs : Set the "no new privileges" value for the process.

--cap cap : Add a capability to the bounding set for the process. Can be specified multiple times.

--preserve-fds N : Pass N additional file descriptors to the container (stdio + $LISTEN_FDS + N in total). Default is 0.

--ignore-paused : Allow exec in a paused container. By default, if a container is paused, runc exec errors out; this option can be used to override it. A paused container needs to be resumed for the exec to complete.

--cgroup path | controller[,controller...]:path : Execute a process in a sub-cgroup. If the specified cgroup does not exist, an error is returned. Default is empty path, which means to use container's top level cgroup. : For cgroup v1 only, a particular controller (or multiple comma-separated controllers) can be specified, and the option can be used multiple times to set different paths for different controllers. : Note for cgroup v2, in case the process can't join the top level cgroup, runc exec fallback is to try joining the cgroup of container's init. This fallback can be disabled by using --cgroup /.

## EXIT STATUS
Exits with a status of command (unless -d is used), or 255 if an error occurred.

## EXAMPLES
If the container can run ps(1) command, the following will output a list of processes running in the container:

```
# runc exec <container-id> ps
```

## SEE ALSO
runc(8).


runc-kill

title: runc-kill(8)

summary: send a specified signal to container

text:
# runc-kill(8)

## NAME
runc-kill - send a specified signal to container

## SYNOPSIS
runc kill container-id [signal]

## DESCRIPTION
By default, runc kill sends SIGTERM to the container's initial process only.

A different signal can be specified either by its name (with or without the SIG prefix), or its numeric value. Use kill(1) with -l option to list available signals.

## EXAMPLES
The following will send a KILL signal to the init process of the ubuntu01 container:

```
# runc kill ubuntu01 KILL
```

## SEE ALSO
runc(1).


runc-list

title: runc-list(8)

summary: lists containers

text:
# runc-list(8)

## NAME
runc-list - lists containers

## SYNOPSIS
runc list [option ...]

## DESCRIPTION
The list commands lists containers. Note that a global --root option can be specified to change the default root. For the description of --root, see runc(8).

## OPTIONS
--format|-f table|json : Specify the format. Default is table. The json format provides more details.

--quiet|-q : Only display container IDs.

## EXAMPLES
To list containers created with the default root:

```
# runc list
```

To list containers in a human-readable JSON (with the help of jq(1) utility):

```
# runc list -f json | jq
```

To list containers created with the root of /tmp/myroot:

```
# runc --root /tmp/myroot
```

## SEE ALSO
runc(8).


runc-pause

title: runc-pause(8)

text:
# runc-pause(8)

## NAME
runc-pause - suspend all processes inside the container

## SYNOPSIS
runc pause container-id

## DESCRIPTION
The pause command suspends all processes in the instance of the container identified by container-id.

Use runc list to identify instances of containers and their current status.

## SEE ALSO
runc-list(8), runc-resume(8), runc(8).


runc-ps

title: runc-ps(8)

text:
# runc-ps(8)

## NAME
runc-ps - display the processes inside a container

## SYNOPSIS
runc ps [option ...] container-id [ps-option ...]

## DESCRIPTION
The command ps is a wrapper around the stock ps(1) utility, which filters its output to only contain processes belonging to a specified container-id. Therefore, the PIDs shown are the host PIDs.

Any ps(1) options can be used, but some might break the filtering. In particular, if PID column is not available, an error is returned, and if there are columns with values containing spaces before the PID column, the result is undefined.

## OPTIONS
--format|-f table|json : Output format. Default is table. The json format shows a mere array of PIDs belonging to a container; if used, all ps options are gnored.

## SEE ALSO
runc-list(8), runc(8).


runc-restore

title: runc-restore(8)

text:
# runc-restore(8)

## NAME
runc-restore - restore a container from a previous checkpoint

## SYNOPSIS
runc restore [option ...] container-id

## DESCRIPTION
Restores the container instance from a previously performed runc checkpoint.

## OPTIONS
--console-socket path : Path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal. See docs/terminals ⟨https://github.com/opencontainers/runc/blob/master/docs/terminals.md⟩.

--image-path path : Set path to get criu image files to restore from.

--work-path path : Set path for saving criu work files and logs. The default is to reuse the image files directory.

--tcp-established : Allow checkpoint/restore of established TCP connections. See criu --tcp-establised option ⟨https://criu.org/CLI/opt/--tcp-established⟩.

--ext-unix-sk : Allow checkpoint/restore of external unix sockets. See criu --ext-unix-sk option ⟨https://criu.org/CLI/opt/--ext-unix-sk⟩.

--shell-job : Allow checkpoint/restore of shell jobs.

--file-locks : Allow checkpoint/restore of file locks. See criu --file-locks option ⟨https://criu.org/CLI/opt/--file-locks⟩.

--manage-cgroups-mode soft|full|strict|ignore. : Cgroups mode. Default is soft. See criu --manage-cgroups option ⟨https://criu.org/CLI/opt/--manage-cgroups⟩.

: In particular, to restore the container into a different cgroup, --manage-cgroups-mode ignore must be used during both checkpoint and restore, and the _containerid (or cgroupsPath property in OCI config, if set) must be changed.

--bundle|-b path : Path to the root of the bundle directory. Default is current directory.

--detach|-d : Detach from the container's process.

--pid-file path : Specify the file to write the initial container process' PID to.

--no-subreaper : Disable the use of the subreaper used to reap reparented processes.

--no-pivot : Do not use pivot root to jail process inside rootfs. This should not be used except in exceptional circumstances, and may be unsafe from the security standpoint.

--empty-ns namespace : Create a namespace, but don't restore its properties. See criu --empty-ns option ⟨https://criu.org/CLI/opt/--empty-ns⟩.

--auto-dedup : Enable auto deduplication of memory images. See criu --auto-dedup option ⟨https://criu.org/CLI/opt/--auto-dedup⟩.

--lazy-pages : Use lazy migration mechanism. This requires a running criu lazy-pages daemon. See criu --lazy-pages option ⟨https://criu.org/CLI/opt/--lazy-pages⟩.

--lsm-profile type:label : Specify an LSM profile to be used during restore. Here type can either be apparamor or selinux, and label is a valid LSM label. For example, --lsm-profile "selinux:system_u:system_r:container_t:s0:c82,c137". By default, the checkpointed LSM profile is used upon restore.

--lsm-mount-context context : Specify an LSM mount context to be used during restore. Only mounts with an existing context will have their context replaced. With this option it is possible to change SELinux mount options. Instead of mounting with the checkpointed context, the specified context will be used. For example, --lsm-mount-context "system_u:object_r:container_file_t:s0:c82,c137".

## SEE ALSO
criu(8), runc-checkpoint(8), runc(8).


runc-resume

title: runc-resume(8)

text:
# runc-resume(8)

## NAME
runc-resume - resume all processes that have been previously paused

## SYNOPSIS
runc resume container-id

## DESCRIPTION
The resume command resumes all processes in the instance of the container identified by container-id.

Use runc list to identify instances of containers and their current status.

## SEE ALSO
runc-list(8), runc-pause(8), runc(8).


runc-run

title: runc-run(8)

summary: create and start a container

text:
# runc-run(8)

## NAME
runc-run - create and start a container

## SYNOPSIS
runc run [option ...] container-id

## DESCRIPTION
The run command creates an instance of a container from a bundle, and starts it. You can think of run as a shortcut for create followed by start.

## OPTIONS
--bundle|-b path : Path to the root of the bundle directory. Default is current directory.

--console-socket path : Path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal. See docs/terminals ⟨https://github.com/opencontainers/runc/blob/master/docs/terminals.md⟩.

--detach|-d : Detach from the container's process.

--pid-file path : Specify the file to write the initial container process' PID to.

--no-subreaper : Disable the use of the subreaper used to reap reparented processes.

--no-pivot : Do not use pivot root to jail process inside rootfs. This should not be used except in exceptional circumstances, and may be unsafe from the security standpoint.

--no-new-keyring : Do not create a new session keyring for the container. This will cause the container to inherit the calling processes session key.

--preserve-fds N : Pass N additional file descriptors to the container (stdio + $LISTEN_FDS + N in total). Default is 0.

--keep : Keep container's state directory and cgroup. This can be helpful if a user wants to check the state (e.g. of cgroup controllers) after the container has exited. If this option is used, a manual runc delete is needed afterwards to clean an exited container's artefacts.

## SEE ALSO
runc(8).


runc-spec

title: runc-spec(8)

summary: create a new specification file

text:
# runc-spec(8)

## NAME
runc-spec - create a new specification file

## SYNOPSIS
runc spec [option ...]

## DESCRIPTION
The spec command creates the new specification file named config.json for the bundle.

The spec generated is just a starter file. Editing of the spec is required to achieve desired results. For example, the newly generated spec includes an args parameter that is initially set to call the sh command when the container is started. Calling sh may work for an ubuntu container or busybox, but will not work for containers that do not include the sh binary.

## OPTIONS
--bundle|-b path : Set path to the root of the bundle directory.

--rootless : Generate a configuration for a rootless container. Note this option is entirely different from the global --rootless option.

## EXAMPLES
To run a simple "hello-world" container, one needs to set the args parameter in the spec to call hello. This can be done using sed(1), jq(1), or a text editor.

The following commands will:

- create a bundle for hello-world;

- change the command to run in a container to /hello using jq(1);

- run the hello command in a new hello-world container named container1.

```
mkdir hello
cd hello
docker pull hello-world
docker export $(docker create hello-world) > hello-world.tar
mkdir rootfs
tar -C rootfs -xf hello-world.tar
runc spec
jq '.process.args |= ["/hello"]' < config.json > new.json
mv -f new.json config.json
runc run container1
```

In the run command above, container1 is the name for the instance of the container that you are starting. The name you provide for the container instance must be unique on your host.

An alternative for generating a customized spec config is to use oci-runtime-tool; its sub-command oci-runtime-tool generate has lots of options that can be used to do any customizations as you want. See runtime-tools ⟨https://github.com/opencontainers/runtime-tools⟩ to get more information.

When starting a container through runc, the latter usually needs root privileges. If not already running as root, you can use sudo(8), for example:

```
sudo runc start container1
```

Alternatively, you can start a rootless container, which has the ability to run without root privileges. For this to work, the specification file needs to be adjusted accordingly. You can pass the --rootless option to this command to generate a proper rootless spec file.

## SEE ALSO
runc-run(8), runc(8).


runc-start

title: runc-start(8)

summary: start a previously created container

text:
# runc-start(8)

## NAME
runc start - start a previously created container

## SYNOPSIS
runc start container-id

## DESCRIPTION
The start command executes the process defined in config.json in a container previously created by runc-create(8).

## SEE ALSO
runc-create(8), runc(8).


runc-state

title: runc-state(8)

summary: show the state of a container

text:
# runc-state(8)

## NAME
runc-state - show the state of a container

## SYNOPSIS
runc state container-id

## DESCRIPTION
The state command outputs current state information for the specified container-id in a JSON format.

## SEE ALSO
runc(8).


runc-update

title: runc-update(8)

text:
# runc-update(8)

## NAME
runc-update - update running container resource constraints

## SYNOPSIS
runc update [option ...] container-id

runc update -r resources.json|- container-id

## DESCRIPTION
The update command change the resource constraints of a running container instance.

The resources can be set using options, or, if -r is used, parsed from JSON provided as a file or from stdin.

In case -r is used, the JSON format is like this:

```
{

    "memory": {

        "limit": 0,

            "reservation": 0,

            "swap": 0,

            "kernel": 0,

            "kernelTCP": 0

    },

        "cpu": {

            "shares": 0,

            "quota": 0,

            "burst": 0,

            "period": 0,

            "realtimeRuntime": 0,

            "realtimePeriod": 0,

            "cpus": "",

            "mems": ""

        },

        "blockIO": {

            "blkioWeight": 0

        }
}
```

## OPTIONS
--resources|-r resources.json : Read the new resource limits from resources.json. Use - to read from stdin. If this option is used, all other options are ignored.

--blkio-weight weight : Set a new io weight.

--cpu-period num : Set CPU CFS period to be used for hardcapping (in microseconds)

--cpu-quota num : Set CPU usage limit within a given period (in microseconds).

--cpu-burst num : Set CPU burst limit within a given period (in microseconds).

--cpu-rt-period num : Set CPU realtime period to be used for hardcapping (in microseconds).

--cpu-rt-runtime num : Set CPU realtime hardcap limit (in usecs). Allowed cpu time in a given period.

--cpu-share num : Set CPU shares (relative weight vs. other containers).

--cpuset-cpus list : Set CPU(s) to use. The list can contain commas and ranges. For example: 0-3,7.

--cpuset-mems list : Set memory node(s) to use. The list format is the same as for --cpuset-cpus.

--memory num : Set memory limit to num bytes.

--memory-reservation num : Set memory reservation, or soft limit, to num bytes.

--memory-swap num : Set total memory + swap usage to num bytes. Use -1 to unset the limit (i.e. use unlimited swap).

--pids-limit num : Set the maximum number of processes allowed in the container.

--l3-cache-schema value : Set the value for Intel RDT/CAT L3 cache schema.

--mem-bw-schema value : Set the Intel RDT/MBA memory bandwidth schema.

## SEE ALSO
runc(8).


chpst

package: runit

title: chpst(8)

text:
# chpst(8)

## NAME
chpst - runs a program with a changed process state

## SYNOPSIS
chpst [-vP012] [-u user] [-U user] [-b argv0] [-e dir] [-/ root] [-n inc] [-l|-L lock] [-m bytes] [-d bytes] [-o n] [-p n] [-f bytes] [-c bytes] prog

## DESCRIPTION
prog consists of one or more arguments.

chpst changes the process state according to the given options, and runs prog.

## OPTIONS
-u [:]user[:group]

setuidgid. Set uid and gid to the user's uid and gid, as found in /etc/passwd. If user is followed by a colon and a group, set the gid to group's gid, as found in /etc/group, instead of user's gid. If group consists of a colon-separated list of group names, chpst sets the group ids of all listed groups. If user is prefixed with a colon, the user and all group arguments are interpreted as uid and gids respectivly, and not looked up in the password or group file. All initial supplementary groups are removed.

-U [:]user[:group]

envuidgid. Set the environment variables $UID and $GID to the user's uid and gid, as found in /etc/passwd. If user is followed by a colon and a group, set $GID to the group's gid, as found in /etc/group, instead of user's gid. If user is prefixed with a colon, the user and group arguments are interpreted as uid and gid respectivly, and not looked up in the password or group file.

-b argv0

argv0. Run prog with argv0 as the 0th argument.

-e dir

envdir. Set various environment variables as specified by files in the directory dir: If dir contains a file named k whose first line is v, chpst removes the environment variable k if it exists, and then adds the environment variable k with the value v. The name k must not contain =. Spaces and tabs at the end of v are removed, and nulls in v are changed to newlines. If the file k is empty (0 bytes long), chpst removes the environment variable k if it exists, without adding a new variable.

-/ root

chroot. Change the root directory to root before starting prog.

-n inc

nice. Add inc to the nice(2) value before starting prog. inc must be an integer, and may start with a minus or plus.

-l lock

lock. Open the file lock for writing, and obtain an exclusive lock on it. lock will be created if it does not exist. If lock is locked by another process, wait until a new lock can be obtained.

-L lock

The same as -l, but fail immediately if lock is locked by another process.

-m bytes

limit memory. Limit the data segment, stack segment, locked physical pages, and total of all segment per process to bytes bytes each.

-d bytes

limit data segment. Limit the data segment per process to bytes bytes.

-o n

limit open files. Limit the number of open file descriptors per process to n.

-p n

limit processes. Limit the number of processes per uid to n.

-f bytes

limit output size. Limit the output file size to bytes bytes.

-c bytes

limit core size. Limit the core file size to bytes bytes.

-v

verbose. Print verbose messages to standard error. This includes warnings about limits unsupported by the system.

-P

pgrphack. Run prog in a new process group.

-0

Close standard input before starting prog.

-1

Close standard output before starting prog.

-2

Close standard error before starting prog.

## EXIT CODES
chpst exits 100 when called with wrong options. It prints an error message and exits 111 if it has trouble changing the process state. Otherwise its exit code is the same as that of prog.

## EMULATION
If chpst is called as envdir, envuidgid, pgrphack, setlock, setuidgid, or softlimit, it emulates the functionality of these programs from the daemontools package respectively.

## SEE ALSO
sv(8), runsv(8), setsid(2), runit(8), runit-init(8), runsvdir(8), runsvchdir(8)

http://smarden.org/runit/

http://cr.yp.to/daemontools.html

## AUTHOR
Gerrit Pape <pape@smarden.org>


runit

title: runit(8)

summary: a UNIX process no 1

text:
# runit(8)

## NAME
runit - a UNIX process no 1

## SYNOPSIS
runit

## DESCRIPTION
runit must be run as Unix process no 1. It performs the system's booting, running, and shutdown in three stages:

## STAGE 1
runit runs /etc/runit/1 and waits for it to terminate. The system's one time tasks are done here. /etc/runit/1 has full control of /dev/console to be able to start an emergency shell if the one time initialization tasks fail. If /etc/runit/1 crashes, or exits 100, runit will skip stage 2 and enter stage 3.

## STAGE 2
runit runs /etc/runit/2, which should not return until system shutdown; if it crashes, or exits 111, it will be restarted. Normally /etc/runit/2 starts runsvdir(8). runit is able to handle the ctrl-alt-del keyboard request in stage 2, see below.

## STAGE 3
If runit is told to shutdown the system, or stage 2 returns, it terminates stage 2 if it is running, and runs /etc/runit/3. The systems tasks to shutdown and possibly halt or reboot the system are done here. If stage 3 returns, runit checks if the file /run/runit.reboot exists and has the execute by owner permission set. If so, the system is rebooted, it's halted otherwise. If /run/runit.nosync exists, runit doesn't invoke sync(). This is useful in vservers.

## CTRL-ALT-DEL
If runit receives the ctrl-alt-del keyboard request and the file /etc/runit/ctrlaltdel exists and has the execute by owner permission set, runit runs /etc/runit/ctrlaltdel, waits for it to terminate, and then sends itself a CONT signal.

## SIGNALS
runit only accepts signals in stage 2.

If runit receives a CONT signal and the file /run/runit.stopit exists and has the execute by owner permission set, runit is told to shutdown the system.

if runit receives an INT signal, a ctrl-alt-del keyboard request is triggered.

## SEE ALSO
runit-init(8), runsvdir(8), runsvchdir(8), sv(8), runsv(8), chpst(8), utmpset(8), svlogd(8)

http://smarden.org/runit/

## AUTHOR
Gerrit Pape <pape@smarden.org>


runit-init

title: runit-init(8)

summary: a UNIX process no 1

text:
# runit-init(8)

## NAME
init - a UNIX process no 1

## SYNOPSIS
init [ 0 | 6 ]

## DESCRIPTION
runit-init is the first process the kernel starts. If runit-init is started as process no 1, it runs and replaces itself with runit(8).

If runit-init is started while the system is up, it must be either called as init 0 or init 6:

init 0

tells the Unix process no 1 to shutdown and halt the system. To signal runit(8) the system halt request, runit-init removes all permissions of the file /run/runit.reboot (chmod 0), and sets the execute by owner permission of the file /run/runit.stopit (chmod 100). Then a CONT signal is sent to runit(8).

init 6

tells the Unix process no 1 to shutdown and reboot the system. To signal runit(8) the system reboot request, runit-init sets the execute by owner permission of the files /run/runit.reboot and /run/runit.stopit (chmod 100). Then a CONT signal is sent to runit(8).

## EXIT CODES
runit-init returns 111 on error, 0 in all other cases.

## SEE ALSO
runit(8), runsvdir(8), runsvchdir(8), sv(8), runsv(8), chpst(8), utmpset(8), svlogd(8)

http://smarden.org/runit/

## AUTHOR
Gerrit Pape <pape@smarden.org>