smartd

title: smartd(8)

summary: SMART Disk Monitoring Daemon

text:
# smartd(8)

## NAME
smartd - SMART Disk Monitoring Daemon

## SYNOPSIS
smartd [options]

## DESCRIPTION
[This man page is generated for the Linux version of smartmontools. It does not contain info specific to other platforms.]

smartd is a daemon that monitors the Self-Monitoring, Analysis and Reporting Technology (SMART) system built into most ATA/SATA and SCSI/SAS hard drives and solid-state drives. The purpose of SMART is to monitor the reliability of the hard drive and predict drive failures, and to carry out different types of drive self-tests. This version of smartd is compatible with ACS-3, ACS-2, ATA8-ACS, ATA/ATAPI-7 and earlier standards (see REFERENCES below).

smartd will attempt to enable SMART monitoring on ATA devices (equivalent to smartctl -s on) and polls these and SCSI devices every 30 minutes (configurable), logging SMART errors and changes of SMART Attributes via the SYSLOG interface. The default location for these SYSLOG notifications and warnings is system-dependent (typically /var/log/messages or /var/log/syslog). To change this default location, please see the '-l' command-line option described below.

In addition to logging to a file, smartd can also be configured to send email warnings if problems are detected. Depending upon the type of problem, you may want to run self-tests on the disk, back up the disk, replace the disk, or use a manufacturer's utility to force reallocation of bad or unreadable disk sectors. If disk problems are detected, please see the smartctl manual page and the smartmontools web page/FAQ for further guidance.

If you send a USR1 signal to smartd it will immediately check the status of the disks, and then return to polling the disks every 30 minutes. See the '-i' option below for additional details.

smartd can be configured at start-up using the configuration file /etc/smartd.conf (Windows: EXEDIR/smartd.conf). If the configuration file is subsequently modified, smartd can be told to re-read the configuration file by sending it a HUP signal, for example with the command:

killall -HUP smartd.

On startup, if smartd finds a syntax error in the configuration file, it will print an error message and then exit. However if smartd is already running, then is told with a HUP signal to re-read the configuration file, and then find a syntax error in this file, it will print an error message and then continue, ignoring the contents of the (faulty) configuration file, as if the HUP signal had never been received.

When smartd is running in debug mode, the INT signal (normally generated from a shell with CONTROL-C) is treated in the same way as a HUP signal: it makes smartd reload its configuration file. To exit smartd use CONTROL-\.

[Linux only] If smartd is started as a systemd(1) service and 'Type=Notify' is specified in the service file, the service manager is notified after successful startup. Other state changes are reported via systemd notify STATUS messages. Notification of successful reloads (after HUP signal) is not supported. To detect this process start-up type, smartd checks whether the environment variable 'NOTIFY_SOCKET' is set. Note that it is required to set the '-n' ('--nofork') option in the 'ExecStart=/usr/sbin/smartd' command line if 'Type=Notify' is used.

On startup, in the absence of the configuration file /etc/smartd.conf, the smartd daemon first scans for all devices that support SMART. The scanning is done as follows:

LINUX:

Examine all entries "/dev/hd[a-t]" for IDE/ATA devices, and "/dev/sd[a-z]", "/dev/sd[a-z][a-z]" for ATA/SATA or SCSI/SAS devices. Disks behind RAID controllers are not included. If directive '-d nvme' or no '-d' directive is specified, examine all entries "/dev/nvme[0-99]" for NVMe devices.

smartd then monitors for all possible SMART errors (corresponding to the '-a' Directive in the configuration file; see the smartd.conf(5) man page).

## OPTIONS
-A PREFIX, --attributelog=PREFIX

Writes smartd attribute information (normalized and raw attribute values) to files 'PREFIX''MODEL-SERIAL.ata.csv' or 'PREFIX''VENDOR-MODEL-SERIAL.scsi.csv'. At each check cycle attributes are logged as a line of semicolon separated triplets of the form "attribute-ID;attribute-norm-value;attribute-raw-value;". For SCSI devices error counters and temperature recorded in the form "counter-name;counter-value;". Each line is led by a date string of the form "yyyy-mm-dd HH:MM:SS" (in local time). MODEL and SERIAL are build from drive identify information, invalid characters are replaced by underline.

If the PREFIX has the form '/path/dir/' (e.g. '/var/lib/smartd/'), then files 'MODEL-SERIAL.ata.csv' are created in directory '/path/dir'. If the PREFIX has the form '/path/name' (e.g. '/var/lib/misc/attrlog-'), then files 'nameMODEL-SERIAL.ata.csv' are created in directory '/path/'. The path must be absolute, except if debug mode is enabled.

-B [+]FILE, --drivedb=[+]FILE

[ATA only] Read the drive database from FILE. The new database replaces the built in database by default. If '+' is specified, then the new entries prepend the built in entries. Please see the smartctl(8) man page for further details.

-c FILE, --configfile=FILE

Read smartd configuration Directives from FILE, instead of from the default location /etc/smartd.conf (Windows: EXEDIR/smartd.conf). If FILE does not exist, then smartd will print an error message and exit with nonzero status. Thus, '-c /etc/smartd.conf' can be used to verify the existence of the default configuration file. By using '-' for FILE, the configuration is read from standard input. This is useful for commands like:

echo /dev/sdb -m user@home -M test | smartd -c - -q onecheck

to perform quick and simple checks without a configuration file.

-C, --capabilities[=mail]

[Linux only] Use libcap-ng to drop unneeded Linux process capabilities(7). The following capabilities are kept in the effective and permissive sets: CAP_SYS_ADMIN, CAP_SYS_RAWIO, CAP_MKNOD. If the '-u, --warn_as_user' option (see below) is used with a non-privileged user or group, the following capabilities are also kept: CAP_SETGID, CAP_SETUID. The capability bounding set is cleared. [NEW EXPERIMENTAL SMARTD 7.3 FEATURE] Mail notification is no longer suppressed if capabilities are dropped. It depends on the local MTA whether mail could be send from a root process with all capabilities dropped. It works with the postfix MTA.

If '--capabilities=mail' is specified, the following capabilities are added to the bounding set: CAP_SETGID, CAP_SETUID, CAP_CHOWN, CAP_FOWNER, CAP_DAC_OVERRIDE. This allows one to send mail with the exim MTA.

-d, --debug

Runs smartd in "debug" mode. In this mode, it displays status information to STDOUT rather than logging it to SYSLOG and does not fork(2) into the background and detach from the controlling terminal. In this mode, smartd also prints more verbose information about what it is doing than when operating in "daemon" mode. In this mode, the INT signal (normally generated from a terminal with CONTROL-C) makes smartd reload its configuration file. Please use CONTROL-\ to exit

-D, --showdirectives

Prints a list (to STDOUT) of all the possible Directives which may appear in the configuration file /etc/smartd.conf, and then exits. These Directives are described in the smartd.conf(5) man page. They may appear in the configuration file following the device name.

-h, --help, --usage

Prints usage message to STDOUT and exits.

-i N, --interval=N

Sets the interval between disk checks to N seconds, where N is a decimal integer. The minimum allowed value is ten and the maximum is the largest positive integer that can be represented on your system (often 2^31-1). The default is 1800 seconds.

[NEW EXPERIMENTAL SMARTD 7.3 FEATURE] The interval could be overridden with the '-c i=N' directive, see smartd.conf(5) man page. Note that the superuser can make smartd check the status of the disks at any time by sending it the SIGUSR1 signal, for example with the command:

kill -SIGUSR1 <pid>

where <pid> is the process id number of smartd. One may also use:

killall -USR1 smartd

for the same purpose.

-l FACILITY, --logfacility=FACILITY

Uses syslog facility FACILITY to log the messages from smartd. Here FACILITY is one of local0, local1, ..., local7, or daemon [default]. If this command-line option is not used, then by default messages from smartd are logged to the facility daemon. If you would like to have smartd messages logged somewhere other than the default location, include (for example) '-l local3' in its start up argument list. Tell the syslog daemon to log all messages from facility local3 to (for example) '/var/log/smartd.log'.

For more detailed information, please refer to the man pages for the local syslog daemon, typically syslogd(8), syslog-ng(8) or rsyslogd(8).

-n, --no-fork

Do not fork into background; this is useful when executed from modern init methods like initng, minit, supervise or systemd.

-p NAME, --pidfile=NAME

Writes pidfile NAME containing the smartd Process ID number (PID). To avoid symlink attacks make sure the directory to which pidfile is written is only writable for root. Without this option, or if the --debug option is given, no PID file is written on startup. If smartd is killed with a maskable signal then the pidfile is removed.

-q WHEN, --quit=WHEN

Specifies when, if ever, smartd should exit. The valid arguments are to this option are: nodev - Exit if there are no devices to monitor, or if any errors are found at startup in the configuration file. This is the default.

errors - Exit if there are no devices to monitor, or if any errors are found in the configuration file /etc/smartd.conf at startup or whenever it is reloaded.

nodevstartup - Exit if there are no devices to monitor at startup. But continue to run if no devices are found whenever the configuration file is reloaded.

never - Only exit if a fatal error occurs (no remaining system memory, invalid command line arguments). In this mode, even if there are no devices to monitor, or if the configuration file /etc/smartd.conf has errors, smartd will continue to run, waiting to load a configuration file listing valid devices.

nodev0 - [NEW EXPERIMENTAL SMARTD 7.3 FEATURE] Same as 'nodev', except that the exit status is 0 if there are no devices to monitor.

nodev0startup - [NEW EXPERIMENTAL SMARTD 7.3 FEATURE] Same as 'nodevstartup', except that the exit status is 0 if there are no devices to monitor.

errors,nodev0 - [NEW EXPERIMENTAL SMARTD 7.3 FEATURE] Same as 'errors', except that the exit status is 0 if there are no devices to monitor.

onecheck - Start smartd in debug mode, then register devices, then check device's SMART status once, and then exit with zero exit status if all of these steps worked correctly.

This last option is intended for 'distribution-writers' who want to create automated scripts to determine whether or not to automatically start up smartd after installing smartmontools. After starting smartd with this command-line option, the distribution's install scripts should wait a reasonable length of time (say ten seconds). If smartd has not exited with zero status by that time, the script should send smartd a SIGTERM or SIGKILL and assume that smartd will not operate correctly on the host. Conversely, if smartd exits with zero status, then it is safe to run smartd in normal daemon mode. If smartd is unable to monitor any devices or encounters other problems then it will return with non-zero exit status.

showtests - Start smartd in debug mode, then register devices, then write a list of future scheduled self tests to stdout, and then exit with zero exit status if all of these steps worked correctly. Device's SMART status is not checked.

This option is intended to test whether the '-s REGEX' directives in smartd.conf will have the desired effect. The output lists the next test schedules, limited to 5 tests per type and device. This is followed by a summary of all tests of each device within the next 90 days.

-r TYPE, --report=TYPE

Intended primarily to help smartmontools developers understand the behavior of smartmontools on non-conforming or poorly-conforming hardware. This option reports details of smartd transactions with the device. The option can be used multiple times. When used just once, it shows a record of the ioctl() transactions with the device. When used more than once, the detail of these ioctl() transactions are reported in greater detail. The valid arguments to this option are: ioctl - report all ioctl() transactions.

ataioctl - report only ioctl() transactions with ATA devices.

scsiioctl - report only ioctl() transactions with SCSI devices.

nvmeioctl - report only ioctl() transactions with NVMe devices.

Any argument may include a positive integer to specify the level of detail that should be reported. The argument should be followed by a comma then the integer with no spaces. For example, ataioctl,2 The default level is 1, so '-r ataioctl,1' and '-r ataioctl' are equivalent.

-s PREFIX, --savestates=PREFIX

Reads/writes smartd state information from/to files 'PREFIX''MODEL-SERIAL.ata.state' or 'PREFIX''VENDOR-MODEL-SERIAL.scsi.state'. This preserves SMART attributes, drive min and max temperatures (-W directive), info about last sent warning email (-m directive), and the time of next check of the self-test REGEXP (-s directive) across boot cycles. MODEL and SERIAL are build from drive identify information, invalid characters are replaced by underline.

If the PREFIX has the form '/path/dir/' (e.g. '/var/lib/smartd/'), then files 'MODEL-SERIAL.ata.state' are created in directory '/path/dir'. If the PREFIX has the form '/path/name' (e.g. '/var/lib/misc/smartd-'), then files 'nameMODEL-SERIAL.ata.state' are created in directory '/path/'. The path must be absolute, except if debug mode is enabled.

The state information files are read on smartd startup. The files are always (re)written after reading the configuration file, before rereading the configuration file (SIGHUP), before smartd shutdown, and after a check forced by SIGUSR1. After a normal check cycle, a file is only rewritten if an important change (which usually results in a SYSLOG output) occurred.

-w PATH, --warnexec=PATH

Run the executable PATH instead of the default script when smartd needs to send warning messages. PATH must point to an executable binary file or script. The default script is /etc/smartd_warning.sh.

-u USER[:GROUP], --warn-as-user=USER[:GROUP]

[NEW EXPERIMENTAL SMARTD 7.3 FEATURE] Run the warning script as a non-privileged user instead of root. The USER and optional GROUP may be specified as numeric ids or names. If no GROUP is specified, the default group of USER is used instead. If a warning occurs, a child process is created with fork(2). This process closes all inherited file descriptors, connects stdio to /dev/null, changes the user and group ids, removes any supplementary group ids and then calls the popen(3) function from the standard library.

If '0:0' is specified, user and group are not changed, but the remaining actions still apply.

If '-' is specified, popen(3) is called directly. This is the default.

-V, --version, --license, --copyright

Prints version, copyright, license, home page and SVN revision information for your copy of smartd to STDOUT and then exits.

## EXAMPLES
smartd

Runs the daemon in forked mode. This is the normal way to run smartd. Entries are logged to SYSLOG.

smartd -d -i 30

Run in foreground (debug) mode, checking the disk status every 30 seconds.

smartd -q onecheck

Registers devices, and checks the status of the devices exactly once. The exit status (the shell $? variable) will be zero if all went well, and nonzero if no devices were detected or some other problem was encountered.

## CONFIGURATION
The syntax of the smartd.conf(5) file is discussed separately.

## NOTES
smartd will make log entries at loglevel LOG_INFO if the Normalized SMART Attribute values have changed, as reported using the '-t', '-p', or '-u' Directives. For example:

'Device: /dev/sda, SMART Attribute: 194 Temperature_Celsius changed from 94 to 93'

Note that in this message, the value given is the 'Normalized' not the 'Raw' Attribute value (the disk temperature in this case is about 22 Celsius). The '-R' and '-r' Directives modify this behavior, so that the information is printed with the Raw values as well, for example:

'Device: /dev/sda, SMART Attribute: 194 Temperature_Celsius changed from 94 [Raw 22] to 93 [Raw 23]'

Here the Raw values are the actual disk temperatures in Celsius. The way in which the Raw values are printed, and the names under which the Attributes are reported, is governed by the various '-v Num,Description' Directives described previously.

Please see the smartctl manual page for further explanation of the differences between Normalized and Raw Attribute values.

smartd will make log entries at loglevel LOG_CRIT if a SMART Attribute has failed, for example:

'Device: /dev/sdc, Failed SMART Attribute: 5 Reallocated_Sector_Ct'

This loglevel is used for reporting enabled by the '-H', -f', '-l selftest', and '-l error' Directives. Entries reporting failure of SMART Prefailure Attributes should not be ignored: they mean that the disk is failing. Use the smartctl utility to investigate.

## LOG TIMESTAMP TIMEZONE
When smartd makes log entries, these are time-stamped. The time stamps are in the computer's local time zone, which is generally set using either the environment variable 'TZ' or using a time-zone file such as /etc/localtime. You may wish to change the timezone while smartd is running (for example, if you carry a laptop to a new time-zone and don't reboot it). Due to a bug in the tzset(3) function of many unix standard C libraries, the time-zone stamps of smartd might not change. For some systems, smartd will work around this problem if the time-zone is set using /etc/localtime. The work-around fails if the time-zone is set using the 'TZ' variable (or a file that it points to).

## EXIT STATUS
The exit status (return value) of smartd can have the following values:

0:

Daemon startup successful, or smartd was killed by a SIGTERM (or in debug mode, a SIGQUIT).

1:

Commandline did not parse.

2:

There was a syntax error in the config file.

3:

Forking the daemon failed.

4:

Couldn't create PID file.

5:

Config file does not exist (only returned in conjunction with the '-c' option).

6:

Config file exists, but cannot be read.

8:

smartd ran out of memory during startup.

10:

An inconsistency was found in smartd's internal data structures. This should never happen. It must be due to either a coding or compiler bug. Please report such failures to smartmontools developers, see REPORTING BUGS below.

16:

A device explicitly listed in /etc/smartd.conf can't be monitored.

17:

smartd didn't find any devices to monitor.

[NEW EXPERIMENTAL SMARTD 7.3 FEATURE] This could be changed to 0 (success) with one of the '-q *nodev0*' options, see above.

254:

When in daemon mode, smartd received a SIGINT or SIGQUIT. (Note that in debug mode, SIGINT has the same effect as SIGHUP, and makes smartd reload its configuration file. SIGQUIT has the same effect as SIGTERM and causes smartd to exit with zero exit status.

132 and above

smartd was killed by a signal that is not explicitly listed above. The exit status is then 128 plus the signal number. For example if smartd is killed by SIGKILL (signal 9) then the exit status is 137.

## FILES
/usr/sbin/smartd

full path of this executable.

/etc/smartd.conf

configuration file (see smartd.conf(5) man page).

/etc/smartd_warning.sh

script run on warnings (see '-w' option above and '-M exec' directive on smartd.conf(5) man page).

/etc/smartd_warning.d/

plugin directory for smartd warning script (see '-m' directive on smartd.conf(5) man page).

/usr/share/smartmontools/drivedb.h

drive database (see '-B' option).

/etc/smart_drivedb.h

optional local drive database (see '-B' option).

## AUTHORS
Bruce Allen (project initiator),

Christian Franke (project manager, Windows port and all sort of things),

Douglas Gilbert (SCSI subsystem),

Volker Kuhlmann (moderator of support and database mailing list),

Gabriele Pohl (wiki & development team support),

Alex Samorukov (FreeBSD port and more, new Trac wiki).

Many other individuals have made contributions and corrections, see AUTHORS, ChangeLog and repository files.

The first smartmontools code was derived from the smartsuite package, written by Michael Cornwell and Andre Hedrick.

## REPORTING BUGS
To submit a bug report, create a ticket in smartmontools wiki:

<https://www.smartmontools.org/>.

Alternatively send the info to the smartmontools support mailing list:

<https://listi.jpberlin.de/mailman/listinfo/smartmontools-support>.

## SEE ALSO
smartd.conf(5), smartctl(8).

update-smart-drivedb(8).

systemd.exec(5).

## REFERENCES
Please see the following web site for more info: <https://www.smartmontools.org/>

An introductory article about smartmontools is Monitoring Hard Disks with SMART, by Bruce Allen, Linux Journal, January 2004, pages 74–77. See <https://www.linuxjournal.com/article/6983>.

If you would like to understand better how SMART works, and what it does, a good place to start is with Sections 4.8 and 6.54 of the first volume of the 'AT Attachment with Packet Interface-7' (ATA/ATAPI-7) specification Revision 4b. This documents the SMART functionality which the smartmontools utilities provide access to.

The functioning of SMART was originally defined by the SFF-8035i revision 2 and the SFF-8055i revision 1.4 specifications. These are publications of the Small Form Factors (SFF) Committee.

Links to these and other documents may be found on the Links page of the smartmontools Wiki at <https://www.smartmontools.org/wiki/Links>.

## PACKAGE VERSION
smartmontools-7.4 2023-08-01 r5530

$Id: smartd.8.in 5521 2023-07-24 16:44:49Z chrfranke $


update-smart-drivedb

package: smartmontools-update-drivedb

title: update-smart-drivedb(8)

summary: update smartmontools drive database

text:
# update-smart-drivedb(8)

## NAME
update-smart-drivedb - update smartmontools drive database

## SYNOPSIS
update-smart-drivedb [OPTIONS] [DESTFILE]

## DESCRIPTION
[This man page is generated for the Linux version of smartmontools. It does not contain info specific to other platforms.]

update-smart-drivedb updates /usr/share/smartmontools/drivedb.h or DESTFILE from branches/RELEASE_7_3_DRIVEDB of smartmontools SVN repository.

The tools used for downloading are either curl(1), wget(1), lynx(1), or svn(1).

The downloaded file is verified with OpenPGP/GPG key ID 721042C5. The public key block is included in the script.

The old file is kept if the downloaded file is identical (ignoring the differences in Id string) otherwise it is moved to drivedb.h.old.

[NEW EXPERIMENTAL UPDATE-SMART-DRIVEDB 7.3 FEATURE] The old file is also kept if the downloaded file reports an older version on the same branch. This could be overridden with the '--force' option. If the branch version differs, the file is always updated.

## OPTIONS
-s SMARTCTL, --smartctl SMARTCTL

Use the smartctl(8) executable at path SMARTCTL for drive database syntax check. The form '-s -' disables the syntax check. The default is /usr/sbin/smartctl.

-t [DIR/]TOOL, --tool [DIR/]TOOL

Use TOOL for download. TOOL is one of: curl wget lynx svn. The default is the first one found in PATH.

[NEW EXPERIMENTAL UPDATE-SMART-DRIVEDB 7.3 FEATURE] A DIR could also be specified. The plain TOOL name must then begin with any of the above names.

-u LOCATION, --url-of LOCATION

Use URL of LOCATION for download. LOCATION is one of:

github (GitHub mirror of SVN repository),

sf (Sourceforge code browser),

svn (SVN repository),

svni (SVN repository via HTTP instead of HTTPS),

trac (Trac code browser).

The default is svn.

--url URL

[NEW EXPERIMENTAL UPDATE-SMART-DRIVEDB 7.3 FEATURE] Download from URL. A valid OpenPGP/GPG signature with '.raw.asc' extension must also exist unless '--no-verify' is also specified.

--file FILE

[NEW EXPERIMENTAL UPDATE-SMART-DRIVEDB 7.3 FEATURE] Copy from local FILE. A valid OpenPGP/GPG signature 'FILE.raw.asc' must also exist unless '--no-verify' is also specified.

--trunk

Download from SVN trunk. This requires '--no-verify' because the trunk versions are not signed.

--branch X.Y

Download from branches/RELEASE_X_Y_DRIVEDB. This also selects the OpenPGP/GPG key for older branches (5.40 to 6.6: Key ID DFD22559).

--cacert FILE

Use CA certificates from FILE to verify the peer.

--capath DIR

Use CA certificate files from DIR to verify the peer.

--insecure

Don't abort download if certificate verification fails. This option is also required if a HTTP URL is selected with '-u' option.

--no-verify

Don't verify signature with GnuPG.

--force

[NEW EXPERIMENTAL UPDATE-SMART-DRIVEDB 7.3 FEATURE] Allow downgrades. By default, the database is not replaced with an older version of the same branch.

--export-key

Print the OpenPGP/GPG public key block.

--dryrun

Print download commands only.

-q, --quiet

[NEW EXPERIMENTAL UPDATE-SMART-DRIVEDB 7.3 FEATURE] Suppress info messages.

-v, --verbose

Verbose output.

-h, --help

Print help text.

## EXAMPLES
Regular update:

```
# update-smart-drivedb
/usr/share/smartmontools/drivedb.h 7.2/5225 updated to 7.2/5237
```

Revert to previous version:

```
# update-smart-drivedb --force \

  --file /usr/share/smartmontools/drivedb.h.old
/usr/share/smartmontools/drivedb.h 7.2/5237 downgraded to 7.2/5225
```

Download the database from SVN trunk to current directory:

```
$ update-smart-drivedb --trunk --no-verify -s - -u trac drivedb-trunk.h
drivedb-trunk.h 7.3/5254 newly installed (NOT VERIFIED)
```

## EXIT STATUS
The exit status is 0 if the database has been successfully updated or is already up to date. If an error occurs the exit status is 1.

## FILES
/usr/sbin/update-smart-drivedb

full path of this script.

/usr/sbin/smartctl

used to check syntax of new drive database.

/usr/share/smartmontools/drivedb.h

current drive database.

/usr/share/smartmontools/drivedb.h.raw

current drive database with unexpanded SVN Id string.

/usr/share/smartmontools/drivedb.h.raw.asc

signature file.

/usr/share/smartmontools/drivedb.h.*old*

previous files.

/usr/share/smartmontools/drivedb.h.*error*

new files if rejected due to errors.

/usr/share/smartmontools/drivedb.h.lastcheck

empty file created if downloaded file was identical.

## AUTHORS
Christian Franke.

This manual page was originally written by Hannes von Haugwitz <hannes@vonhaugwitz.com>.

## REPORTING BUGS
To submit a bug report, create a ticket in smartmontools wiki:

<https://www.smartmontools.org/>.

Alternatively send the info to the smartmontools support mailing list:

<https://listi.jpberlin.de/mailman/listinfo/smartmontools-support>.

## SEE ALSO
smartctl(8), smartd(8).

## PACKAGE VERSION
smartmontools-7.4 2023-08-01 r5530

$Id: update-smart-drivedb.8.in 5521 2023-07-24 16:44:49Z chrfranke $


smbldap-config

package: smbldap-tools

title: smbldap-config(8)

summary: Smbldap\-config

text:
# smbldap-config(8)

## NAME
smbldap-config - Smbldap-config

## DESCRIPTION
The smbldap-config command configure


smbldap-groupadd

title: smbldap-groupadd(8)

summary: Create a new group

text:
# smbldap-groupadd(8)

## NAME
smbldap-groupadd - Create a new group

## SYNOPSIS
smbldap-groupadd [-g gid ] [-a] [-o] [-r rid] [-s sid] [-t group type] [-p] group

## DESCRIPTION
The smbldap-groupadd command creates a new group account using the values specified on the command line and the default values from the configuration file. The new group will be entered into the system files as needed. Available options are :

-g gid

The numerical value of the group's ID. This value must be

unique, unless the -o option is used. The value must be non-

negative. The default is to use the smallest ID value greater

than 1000 and greater than every other group.

-a

add an automatic Security ID for the group (SID).

-b

the group is also a AIX group

-o

gid is not unique

-p

print the gidNumber to stdout

-s sid

set the group SID.

The SID must be unique and defined with the domain Security ID

($SID) like sid=$SID-rid where rid is the group rid.

-r rid

set the group rid.

The SID is then calculated as sid=$SID-rid where $SID is the

domain Security ID.

-t group type

set the NT Group type for the new group. Available values are

2 (domain group), 4 (local group) and 5 (builtin group).

The default group type is 2.

## SEE ALSO
groupadd(1)


smbldap-groupdel

title: smbldap-groupdel(8)

summary: Delete a group

text:
# smbldap-groupdel(8)

## NAME
smbldap-groupdel - Delete a group

## SYNOPSIS
smbldap-groupdel group

## DESCRIPTION
The smbldap-groupdel command modifies the system account files, deleting all entries that refer to a group. The named group must exist.

You must manually check all filesystems to insure that no files remain with the named group as the file group ID.

## SEE ALSO
groupdel(1)


smbldap-grouplist

title: smbldap-grouplist(8)

summary: list groups

text:
# smbldap-grouplist(8)

## NAME
smbldap-grouplist - list groups

## SYNOPSIS
smbldap-grouplist [-S] [group template]

## DESCRIPTION
-d Show displayName

-S Show samba SID entry

-? show the help message

## EXAMPLE
smbldap-grouplist -dS

smbldap-grouplist "*ourn*"


smbldap-groupmod

title: smbldap-groupmod(8)

summary: Modify a group

text:
# smbldap-groupmod(8)

## NAME
smbldap-groupmod - Modify a group

## SYNOPSIS
smbldap-groupmod [-g gid [-o]] [-a] [-r rid] [-s sid] [-t group type] [-n group_name ] [-m members(,)] [-x members (,)] group

## DESCRIPTION
The smbldap-groupmod command modifies the system account files to reflect the changes that are specified on the command line. The options which apply to the smbldap-groupmod command are

-g gid The numerical value of the group's ID. This value must be unique, unless the -o option is used. The value must be non negative. Any files which the old group ID is the file roup ID must have the file group ID changed manually.

-n group_name

The name of the group will be changed from group to group_name.

-m members

The members to be added to the group in comma-delimeted form.

-x members

The members to be removed from the group in comma-delimted form.

-a

add an automatic Security ID for the group (SID).

-s sid

set the group SID.

The SID must be unique and defined with the domain Security ID ($SID) like sid=$SID-rid where rid is the group rid.

-r rid

set the group rid.

The SID is then calculated as sid=$SID-rid where $SID is the domain Security ID.

-t group type

set the NT Group type for the new group. Available values are 2 (domain group), 4 (local group) and 5 (builtin group). The default group type is 2.

## EXAMPLES
smbldap-groupmod -g 253 development This will change the GID of the 'development' group to '253'.

smbldap-groupmod -n Idiots Managers This will change the name of the 'Managers' group to 'Idiots'.

smbldap-groupmod -m "jdoe,jsmith" "Domain Admins" This will add 'jdoe' and 'jsmith' to the 'Domain Admins' group.

smbldap-groupmod -x "jdoe,jsmith" "Domain Admins" This will remove 'jdoe' and 'jsmith' from the 'Domain Admins' group.

## SEE ALSO
groupmod(1)


smbldap-groupshow

title: smbldap-groupshow(8)

summary: Display group informations

text:
# smbldap-groupshow(8)

## NAME
smbldap-groupshow - Display group informations

## SYNOPSIS
smbldap-groupshow groupname

## DESCRIPTION
The smbldap-groupshow command displays informations associated with the given group.


smbldap-passwd

title: smbldap-passwd(8)

summary: change user password

text:
# smbldap-passwd(8)

## NAME
smbldap-passwd - change user password

## SYNOPSIS
smbldap-passwd [-?|--help|-s|-u] [name]

## DESCRIPTION
smbldap-passwd changes passwords for user accounts. A normal user may only change the password for their own account, the super user may change the password for any account.

If option -s specified then changed only samba password. If options -u specified then changed only UNIX password. With no options then changed both - UNIX and samba passwords.

Password Changes The user is first prompted for their old password, if one is present. This password is then tested against the stored password by binding to the server. The user has only one chance to enter the correct passwword. The super user is permitted to bypass this step so that forgotten passwords may be changed. The user is then prompted for a replacement password. As a general guideline, passwords should consist of 6 to 8 characters including one or more from each of following sets:

Lower case alphabetics

Upper case alphabetics

Digits 0 thru 9

Punctuation marks

Password will prompt again and compare the second entry against the first. Both entries are require to match in order for the password to be changed.

## SEE ALSO
passwd(1)


smbldap-populate

title: smbldap-populate(8)

summary: Populate your LDAP database

text:
# smbldap-populate(8)

## NAME
smbldap-populate - Populate your LDAP database

## SYNOPSIS
smbldap-populate [ldif-file]

## DESCRIPTION
The smbldap-populate command helps to populate an LDAP server by adding the necessary entries : base suffix (doesn't abort if already there), organizational units for users, groups and computers, builtin users : Administrator and guest, builtin groups (though posixAccount only, no SambaTNG support).

-a name Your local administrator login name (default: root)

-b name Your local guest login name (default: nobody)

-e file export an ldif file

-i file import an ldif file (Options -a and -b will be ignored)

## FILES
/etc/smbldap-tools/smbldap.conf : main configuration /etc/smbldap-tools/smbldap_bind.conf : credentials for binding to the directory

## SEE ALSO
smb.conf(5)


smbldap-useradd

title: smbldap-useradd(8)

summary: Create a new user

text:
# smbldap-useradd(8)

## NAME
smbldap-useradd - Create a new user

## SYNOPSIS
smbldap-useradd [-abinwPW] [-c comment] [-d home_dir] [-g initial_group] [-m [-k skeleton_dir]] [-o user_ou] [-s shell] [-t time] [-u uid] [-A canchange] [-B mustchange] [-C smbhome] [-D homedrive] [-E scriptpath] [-F profilepath] [-G group[,...]] [-H acctflags] [-M mailaddr[,...]] [-N givenname] [-O mailaddr[,...]] [-S surname] [-T mailaddr[,...]] [-X encoding] [-Z name=value[,...]] login

## DESCRIPTION
Creating New Users The smbldap-useradd command creates a new user account using the values specified on the command line and the default values from the system and from the configuration files (in the /etc/smbldap-tools directory).

Without any option, the account created will be a Unix (Posix) account. The following options may be used to add information:

-a

The user will have a Samba account (and Unix).

-A

Can change password? 0 if no, 1 if yes.

-b

The user is an AIX account.

-B

Must change password? 0 if no, 1 if yes.

-c "comment"

The new user's comment field (gecos). This option is for gecos only! To set as user's full name use the -N and -S options.

-C sambaHomePath

SMB home share, like '\\\\PDC-SRV\\homes'.

-d home_dir

The new user will be created using home_dir for the user's login directory. The default is to append the login name to userHomePrefix (defined in the configuration file) and use that as the login directory name.

-D sambaHomeDrive

Letter associated with home share, like 'H:'.

-E sambaLogonScript

Relative to the [netlogon] share (DOS script to execute on login, like 'foo.bat'.

-F sambaProfilePath

Profile directory, like '\\\\PDC-SRV\\profiles\\foo'.

-g initial_group

The group name or number of the user's initial login group. The group name must exist. A group number must refer to an already existing group. The default group number is defined in the configuration file (defaultUserGid="513").

-G group,[...]

A list of supplementary groups that the user is also a member of. Each group is separated from the next by a comma, with no intervening whitespace. The groups are subject to the same restrictions as the group given with the -g option. The default is for the user to belong only to the initial group.

-H sambaAcctFlags

Spaces and trailing bracket are ignored (samba account control bits like '[NDHTUMWSLKI]').

-i

Creates an interdomain trust account (machine Workstation). A password will be asked for the trust account.

-k skeletonDir

When creating the user's home directory, copy files and directories from skeletonDir rather than /etc/skel. The -k option is only valid in conjunction with the -m option. The default is not to create the directory and not to copy any files.

-m

The user's home directory will be created if it does not exist. The files contained in skeletonDir will be copied to the home directory if the -k option is used, otherwise the files contained in /etc/skel will be used instead. Any directories contained in skeletonDir or /etc/skel will be created in the user's home directory as well.

-M mail

E-mail addresses (multiple addresses are separated by commas).

--non-unique

Allow the creation of a user account with a duplicate (non-unique) UID.

-n

Do not print banner message.

-N givenname

Family name. Defaults to username.

-o node

The user's account will be created in the specified organizational unit. It is relative to the user suffix dn ($usersdn) defined in the configuration file. Ex: 'ou=admin,ou=all'

-O localMailAddress

localMailAddresses (multiple addresses are separated by commas).

-P

Ends by invoking smbldap-passwd.

-p

Read password from STDIN without verification.

-s shell

The name of the user's login shell. The default is to leave this field blank, which causes the system to select the default login shell.

-S surname

Defaults to username.

-t time

Wait <time> seconds before exiting script when adding computer's account. This is useful when Master/PDC and Slaves/BDCs are connected through the Internet (replication is not real time).

-T mailToAddress

Forward address (multiple addresses are separated by commas).

-u uid

The numerical value of the user's ID. This value must be unique, unless the --non-unique option is used. The value must be non-negative. The default is to use the smallest ID value greater than 1000 and greater than every other user.

-w/-W

Creates an account for a Samba machine (Workstation), so that it can join a sambaDomainName. Normally -w is used for adding machines through Samba but -W can be used for manual addition of samba attributes.

-X encoding

Specify input encoding for givenname and surname (default UTF-8).

-Z name=value

Specify custom LDAP attributes, using comma-separated name=value pairs.

## SEE ALSO
useradd(1)


smbldap-userdel

title: smbldap-userdel(8)

summary: Delete a user account and related files

text:
# smbldap-userdel(8)

## NAME
smbldap-userdel - Delete a user account and related files

## SYNOPSIS
smbldap-userdel [-r] login

## DESCRIPTION
The smbldap-userdel command modifies the system account files, deleting all entries that refer to user defined in "login". The named user must exist.

-r Files in the user's home directory will be removed along with the home directory itself. Files located in other file systems will have to be searched for and deleted manually.

## SEE ALSO
userdel(1)


smbldap-userinfo

title: smbldap-userinfo(8)

text:
# smbldap-userinfo(8)

## NAME
smbldap-userinfo - change user real name, information and shell

## SYNOPSIS
smbldap-userinfo [-f full_name] [-r room_no] [-w work_ph] [-h home_ph] [-o other] [-s login_shell] [-l] [-?] [-v]

## DESCRIPTION
This command changes user gecos fields and login shell. The normal user can change only the fields for his own account, the super user may change the fiels for any account.

If none of the options are selected, the command is run in an interactive mode for the current user account. User is asked for all fields. To accept a default value you should just press <ENTER>, otherwise write text and press <ENTER>.

posixAccount objectClasses has to be present in the modified entry. If inetOrgPerson objectClass is also present additional attributes will be changed (givenName,sn,roomNumber,telephoneNumber, homePhone)

-l

Display users informations and password status.

-f full_name

affected attributes: 'gecos', 'cn' (and 'givenName', 'sn'

if inetOrgPerson is present)

-r room_number

affected attributes: 'gecos' (and 'roomNumber'

if inetOrgPerson is present)

-w work_phone

affected attributes: 'gecos' (and 'telephoneNumber'

if inetOrgPerson is present)

-h home_phone

affected attributes: 'gecos' (and 'homePhone'

if inetOrgPerson is present)

-o other

affected attributes: 'gecos'

-s login_shell

affected attributes: 'loginShell'

-? show the help message

-v verbose - show modified user entry


smbldap-userlist

title: smbldap-userlist(8)

summary: list users or machines with some info

text:
# smbldap-userlist(8)

## NAME
smbldap-userlist - list users or machines with some info

## SYNOPSIS
smbldap-userlist [-a] [-g] [-d] [-e] [-l] [-m] [user template]

## DESCRIPTION
-a Show gecos, password last change, expiration date and account status

-g Show gecos entry

-d Show last modification password date

-e Show the expiration date

-l Show account status (locl/unlock)

-m Only list machines

-u Only list users

-? show the help message

## EXAMPLE
smbldap-userlist -a

smbldap-userlist -a jtournier

smbldap-userlist -a "*ourn*"


smbldap-usermod

title: smbldap-usermod(8)

summary: Modify a user account

text:
# smbldap-usermod(8)

## NAME
smbldap-usermod - Modify a user account

## SYNOPSIS
smbldap-usermod [-c gecos] [-d home_dir] [-r login_name] [-u uid] [-g gid] [-o] [-G group[,...]] [-s shell] [-N first_name] [-S surname] [-P] [-M mail[,...]] [-T mail,[..]] [--shadowExpire date/n] [--shadowMax n] [--shadowMin n] [--shadowInactive n] [--shadowWarning n] [-L] [-U] [-a] [-e expiration_date/n] [--sambaExpire date/n] [-A canchange] [-B mustchange] [-C smbhome] [-D homedrive] [-E scriptpath] [-F profilepath] [-H acctflags] [-I] [-J] [-h] login

## DESCRIPTION
The smbldap-usermod command modifies the system account files to reflect the changes that are specified on the command line.

### UNIX options
-c, --gecos gecos

The new value of the user's comment field (gecos). (Don't use this to modify displayName or cn. Use -N and -S options combined instead).

-d, --homedir home_dir

The user's new login directory.

-r, --rename new_user

Allow to rename a user. This option will update the dn attribute for the user. You can also update others attributes using the corresponding script options.

-u, --uid uid

The numerical value of the user's ID. This value must be unique, unless the -o option is used. The value must be non negative. Any files which the user owns and which are located in the directory tree rooted at the user's home directory will have the file user ID changed automatically. Files outside of the user's home directory must be altered manually.

-o, --canBeNotUnique

uidNumber can be non unique

-g, --gid initial_group

The group name or number of the user's new initial login group. The group name must exist. A group number must refer to an already existing group. The default group number is 1.

-G, --group [+-]group,[...]

A list of supplementary groups which the user is also a member of. Each group is separated from the next by a comma, with no intervening whitespace. The groups are subject to the same restrictions as the group given with the -g option. If the user is currently a member of a group which is not listed, the user will be removed from the group, unless the '+' or '-' caracter is used to add or remove groups to inital ones.

-s, --shel shell

The name of the user's new login shell. Setting this field to blank causes the system to select the default

login shell.

-N, --givenName

set the user's given name (attribute givenName). Additionally used to set the first name in displayName and cn.

-S, --surname

Set the user's surname (attribute sn). Additionally used to set the last name in displayName and cn.

-P

End by invoking smbldap-passwd to change the user password (both unix and samba passwords)

-M, --mailAddresses mail,[...]

mailAddresses (comma seperated)

-T, --mailToAddress mail,[...]

mailToAddress (forward address) (comma seperated)

--shadowExpire <YYYY-MM-DD/n>

Set the expiration date for the user password. This only affect unix account. The date may be specified as either YYYY-MM-DD or 'n' days from day. The 'n' syntax also supports the extended format (#y)(#m)(#d) for years, months, and days from today. One need not specify all three, so all of the following are examples of valid input: '5y4m2d' (5 years, 4 months, and 2 days), '5y' (5 years), '5y2d' (5 years and 2 days), and '3' (3 days). This option calls the internal 'timelocal' command to set calculate the number of seconds from Junary 1 1970 to the specified date.

--shadowMax <n>

User must change the password, at least, every 'n' days

--shadowMin <n>

User must wait 'n' days once the password has changed before changing it again

--shadowInactive <n>

Number of days of inactivity allowed for the specified user

--shadowWarning <n>

User is warned that the password must be changed four days before the password expires

-L, --shadowLock

Lock unix user's password. This puts a '!' in front of the encrypted password, effectively disabling the password.

-U, --shadowUnlock

Unlock unix user's password. This removes the '!' in front of the encrypted password.

### SAMBA options
-a, --addsambaSAMAccount

Add the sambaSAMAccount objectclass to the specified user account. This allow the user to become a samba user.

-e, --expire <YYYY-MM-DD(HH:MM:SS)/n>

Sets the expiration for both samba (--sambaExpire) and shadow (--shadowExpire).

--ou node

The user's account will be moved to the specified organazional unit. It is relative to the user suffix dn ($usersdn) defined in the configuration file.

Ex: 'ou=admin,ou=all'

--sambaExpire <YYYY-MM-DD HH:MM:SS/n>

Set the expiration date for the user account. This only affects the samba account. The date must be in the following format: YYYY-MM-DD HH:MM:SS. The n-days format of shadowExpire is also supported. This option uses the internal 'timelocal' command to set calculate the number of seconds from Junary 1 1970 to the specified date.

-A, --sambaPwdCanChange

can change password ? 0 if no, 1 if yes

-B, --sambaPwdMustChange

must change password ? 0 if no, 1 if yes

-C, --sambaHomePath path

sambaHomePath (SMB home share, like '\\\\PDC-SRV\\homes')

-D, --sambaHomeDrive drive

sambaHomeDrive (letter associated with home share, like 'H:')

-E, --sambaLogonScript script

sambaLogonScript, relative to the [netlogon] share (DOS script to execute on login, like 'foo.bat')

-F, --sambaProfilePath path

sambaProfilePath (profile directory, like '\\\\PDC-SRV\\profiles\\foo')

-H, --sambaAcctFlags flags

sambaAcctFlags, spaces and trailing bracket are ignored (samba account control bits like '[NDHTUMWSLKI]')

-I, --sambaDisable

disable user. Can't be used with -H or -J

-J, --sambaEnable

enable user. Can't be used with -H or -I

-h, --help

print this help

## SEE ALSO
usermod(1)


smbldap-usershow

title: smbldap-usershow(8)

summary: Show a user account informations

text:
# smbldap-usershow(8)

## NAME
smbldap-usershow - Show a user account informations

## SYNOPSIS
smbldap-usershow login

## DESCRIPTION
The smbldap-usershow command displays the informations associated with the login. The named user must exist.


smcroutectl

package: smcroute

title: smcroutectl(8)

summary: Control and status tool for

text:
# smcroutectl(8)

## NAME
smcroutectl — Control and status tool for smcrouted(8)

## SYNOPSIS
smcroutectl

[-bdptv] [-i NAME] [-u FILE] [COMMAND]

smcroutectl

⟨help | flush | kill | reload | version⟩

smcroutectl

⟨show⟩ [groups | routes]

smcroutectl

⟨add | rem⟩ IIF [SOURCE] GROUP[/LEN] OIF [OIF ...]

smcroutectl

⟨join | leave⟩ IIF [SOURCE] GROUP[/LEN]

## DESCRIPTION
smcroutectl is the control tool for smcrouted(8). It can be used to query status, debug, modify the kernel multicast forwarding cache (MFC), manage group interface memberships, reload smcroute.conf, and kill a running smcrouted.

## OPTIONS
The following smcroutectl options are available:

-b

Batch mode, read commands from stdin.

```
$ sudo smcroutectl -b <<-EOF
	join eth0 225.1.2.3
	add eth0 192.168.1.42 225.1.2.3 eth1 eth2
	rem eth1 225.3.4.5 eth3
	leave eth1 225.3.4.5
	EOF
```

-d

Enable detailed output in show commands.

-i NAME

Connect to an smcrouted instance that runs with another identity, NAME. This option is required for both smcrouted and smcroutectl when running multiple smcrouted instances, e.g., when using multiple routing tables, on Linux.

-p

Use plain table headings in show command output. No ANSI control characters are used, not even for probing screen width.

-t

Skip table headings entirely in show command output.

-u FILE

UNIX domain socket path, used for the IPC between smcrouted and smcroutectl. Use this to override the default socket path, otherwise derived from the identity, -i NAME. This option can be useful when overriding the identity is not sufficient, e.g. for testing. The default depends on how smcroutectl is configured at build time, see FILES.

## OPERATION
The IIF and OIF arguments in the below smcroutectl commands are the interface names, or interface wildcards of the form eth+, which matches eth0, eth10, etc. Wildcards are available for both inbound and outbound interfaces.

A multicast route is defined by an input interface IIF, the sender's unicast IP address SOURCE, which is optional, the multicast group GROUP and a list of, at least one, output interface OIF [OIF ...].

Please refer to smcrouted(8) for more details on the operation and how ASM/SSM multicast works.

## COMMANDS
Commands can be abbreviated to the minimum unambiguous prefix; for example, s g for show groups. The following commands are available:

add IIF [SOURCE[/LEN]] GROUP[/LEN] OIF [OIF ...]

Add a new multicast route the the kernel MFC, or modify the outbound interfaces (OIF) an existing route. The arguments are, in order: IIF the inbound interface, SOURCE originating IP address (may need to be reachable in the unicast routing table to be allowed by the kernel reverse-path check), GROUP the multicast group address, and OIF [OIF ...] the outbound network interface(s).

The interfaces provided as IIF and OIF can be any multicast capable network interface as listed by ‘ifconfig’ or ‘ip link list’, including tunnel interfaces and loopback. Provided smcrouted has "enumerated" them. See smcrouted(8), in particular the command line option -N, and the smcroute.conf(5) ‘phyint’ directive.

To add a (*,G) route, either omit the SOURCE argument completely, or set it to 0.0.0.0 for IPv4, and if you want to specify a range of groups, use the ‘GROUP/LEN’ modifier, e.g. ‘225.0.0.0/24’.

remove IIF [SOURCE[/LEN]] GROUP[/LEN] [OIF [OIF ...]]

Remove or modify the outbound interfaces of a multicast route in the kernel MFC. When no OIF argument is given, this command removes the entire route. With one or more OIF arguments, each outbound interface listed is removed. Skipping any unmatched or invalid interface names. When no more outbound interfaces exist, the route will have been transformed into a "stop filter". To remove the route entirely, the command must be given with no OIF arguments.

flush

Flush dynamic (*,G) multicast routes now. Similar to how -c SEC works in smcrouted, this command initiates an immediate flush of all dynamically installed (*,G) multicast routes. Useful when a topology change has been detected and need to be propagated to smcrouted.

join IIF [SOURCE[/LEN]] GROUP[/LEN]

Join a multicast group, with an optional prefix length, on the given (inbound) interface. The source address is optional, but if given a source specific (SSM) join is performed. Note, joining groups is only ever necessary on the inbound interface, never on the outbound. Unless, two-way routing the same group. Note, as mentioned in smcrouted(8), joining a group to open up traffic in layer-2 network switches is only a workaround to direct multicast towards SMCRoute. When routing lots of traffic it is advised to avoid this mechanism. Instead, use multicast router ports, or similar settings on the switches, or if they support multicast router discovery (MRDISC), see RFC4286.

leave IIF [SOURCE[/LEN]] GROUP[/LEN]

Leave a multicast group, with optional prefix length, on a given (inbound) interface. As with the join command, above, the source address is optional, but if the group was subscribed to with source it must be unsubscribed with source as well.

help [cmd]

Print a usage information message.

kill

Tell a running smcrouted to exit gracefully, same as SIGTERM.

reload

Tell smcrouted to reload its configuration and activate the changes. Same as SIGHUP. Note, any routes or groups added or removed with smcroutectl will be lost. Only the configuration set in the file smcroute.conf is activated.

show [groups|routes]

Show joined multicast groups or multicast routes, defaults to show routes. Can be combined with the -d option to get details for each multicast route.

version

Show program version and support information.

## SEE ALSO
smcrouted(8), smcroute.conf(5)

## AUTHORS
SMCRoute was originally created by Carsten Schill <carsten@cschill.de>. Initial IPv6 support by Todd Hayton <todd.hayton@gmail.com>. Initial FreeBSD support by Micha Lenk <micha@debian.org>.

SMCRoute is currently maintained by Joachim Wiberg <troglobit@gmail.com>, and Micha Lenk <micha@debian.org> at GitHub.


smcrouted

title: smcrouted(8)

summary: SMCRoute, a static multicast router

text:
# smcrouted(8)

## NAME
smcrouted — SMCRoute, a static multicast router

## SYNOPSIS
smcrouted

[-nNhsv] [-c SEC] [-d SEC] [-e CMD] [-f FILE] [-F FILE] [-i NAME] [-l LVL] [-m SEC] [-p USER:GROUP] [-P FILE] [-t ID] [-u FILE]

## DESCRIPTION
smcrouted is a static multicast routing daemon providing fine grained control over the multicast forwarding cache (MFC) in the UNIX kernel. Both IPv4 and IPv6 are fully supported.

smcrouted can be used as an alternative to dynamic multicast daemons like mrouted(8), pimd(8) or pim6sd(8) in situations where static multicast routes should be maintained and/or no proper IGMP or MLD signaling exists.

Multicast routes exist in the UNIX kernel only as long as a multicast routing daemon is running. On Linux, multiple multicast routers can run simultaneously using different multicast routing tables. To run smcrouted and, mrouted at the same time, set the former to use a routing table other than the default (0).

smcrouted modifies the kernel routing table and needs either full superuser rights, or CAP_NET_ADMIN on Linux. This also applies to the friendly control tool smcroutectl(8).

### Warning
Be careful when creating multicast routes. You can easily flood your networks by inadvertently creating routing loops. Either direct loops listing an inbound interface also as an outbound, or indirect loops by going through other routers.

## OPTIONS
The following command line options are available:

-c SEC

Flush unused dynamic (*,G) multicast routes every SEC seconds. This option is intended for systems with topology changes, i.e., when inbound multicast may change both interface and source IP address. E.g. in a setup with at least two VRRP routers. If there is no way of detecting such a topology change this option makes sure to periodically flush all dynamically learned multicast routes so that traffic may resume. Flushing of a specific route only occurs if it was unused during the last flush interval, i.e. there was no traffic matching it. This avoids toggling between different inbound interfaces if traffic arrives on several interfaces simultaneously. In this case, the first selected inbound interface is retained until traffic on it ceases.

Default is 60 sec, set to 0 to disable. See also the smcroutectl flush command, which can be called manually on topology changes.

-d SEC

Daemon startup delay. Delays the probe of interfaces and parsing of the configuration file. Note, the PID file is also not created, since the daemon is not ready yet. This command line option, although useful in some use-cases, is fragile. It is almost always better to rely on an init or process supervisor that handles dependencies properly, like finit(8), which can wait for interfaces to come up and files to be created before starting a service.

-e CMD

Specify external script or command to be called when smcrouted has loaded/reloaded all static multicast routes from the configuration file, or when a source-less (ANY) rule has been installed.

-f FILE

Alternate configuration file, default /etc/smcroute.conf

-F FILE

Check configuration file syntax, use -l LEVEL to increase verbosity. Returns non-zero on error.

-h

Show summary of command line options and exit.

-i NAME

Set daemon identity. Used to create unique PID, IPC socket, and configuration file names, as well as set the syslog identity. E.g., -I foo would make smcrouted look for /etc/foo.conf, write its PID to /var/run/foo.pid and create an IPC socket for smcroutectl in /var/run/foo.sock. For smcroutectl the same option can be used to select the proper smcrouted instance to send IPC to.

This option is required for both daemon and client when running multiple smcrouted instances, using multiple routing tables, on Linux.

-l LEVEL

Set log level: none, err, notice, info, debug. Default is notice.

-m SEC

Modify Multicast Router Discovery (mrdisc) announcement interval. Default 20 sec. This option is only available when smcrouted is built with mrdisc support (Linux, and IPv4, only). RFC4286.

-n

Run daemon in foreground, do not detach from controlling terminal

-N

By default smcrouted enables multicast routing on all available, and multicast capable, interfaces in the system. These interfaces are enumerated as VIFs, virtual interfaces, of which most UNIX systems have a very limited amount, usually 32. This daemon option inverts the behavior so no interfaces are enabled by default. Useful on systems with many interfaces, where multicast routing only makes use of a few. The config file setting phyint IFNAME enable is required to enable the required interfaces.

-p USER [:GROUP]

Drop root privileges to USER:GROUP after start and retain CAP_NET_ADMIN capabilities only. The :GROUP is optional. This option is only available when smcrouted is built with libcap support.

-P FILE

Set PID file name, and optionally full path, in case you need to override the default identity, or the identity set with -i NAME. Regardless, setting this option overrides all others, but it is recommended to use the ident option instead.

-s

Let daemon log to syslog, default unless running in foreground.

-t ID

Set multicast routing table ID. Remember to also create routing rules directing packets to the table. This example uses routing table ID 123:

```
ip mrule add iif eth0 lookup 123
ip mrule add oif eth0 lookup 123
```

Note: Only available on Linux.

-u FILE

UNIX domain socket path, used for the IPC between smcrouted and smcroutectl. Use this to override the default socket path, derived from the daemon identity, -i NAME. This option can be useful when overriding the identity is not sufficient, e.g. for testing. The default depends on how smcrouted is configured at build time, see FILES.

-v

Show program version and support information.

The -e CMD option is useful if you want to trigger other processes to start when smcrouted has completed installing dynamic multicast routes from (*,G) rules in /etc/smcroute.conf, or when a source-less (ANY) route, a.k.a (*,G) multicast rule, from /etc/smcroute.conf. is matched and installed. For instance, calling conntrack on Linux to flush firewall connection tracking when NAT:ing multicast.

The script CMD is called with an argument reload or install to let the script know if it is called on SIGHUP/startup, or when a (*,G) rule is matched and installed. In the latter case smcrouted also sets two environment variables: source, and group. Beware that these environment variables are unconditionally overwritten by smcrouted and can thus not be used to pass information to the script from outside of smcrouted.

## OPERATION

### Introduction
When smcrouted starts up it scans for available network interfaces that have the MULTICAST flag set. Provided the -N flag is not set, each interface is enumerated as a virtual interface (VIF) which is what the kernel's multicast routing stack uses. The enumeration process on some operating systems also require each interface to have an IP address, but Linux and FreeBSD systems only require the ifindex and the MULTICAST flag. If the interface does not yet exist when smcrouted starts, the -d SEC flag can be used to delay startup. Otherwise smcrouted needs to be reloaded (e.g., using SIGHUP) when a new interface has been added to the system.

Since VIFs are a limited resource, most operating systems only support 32 in total, the administrator may need to declare which interfaces to use for multicast routing using the /etc/smcroute.conf phyint directive. It is recommended to always start smcrouted with the -N flag, disabling VIF creation by default, and then selectively enable each of the interfaces you are going to route between. See smcroute.conf(5) for more information.

### Multicast Scoping
Because multicast inherently is broadcast there is an obvious need to limit. On a LAN this is usually managed automatically by bridges (switches) with built-in multicast snooping (IGMP and MLD). Between LANs there is also the need to scope multicast, often the same multicast groups are used for different purposes on different LANs. This must be managed by administrators, at least three options exist:

TTL scoping

The traditional way of "raising walls" between zones. The outbound interfaces of routers are given a TTL threshold greater than the hop it represents. The default TTL threshold is 1. Managing the routers is a lot easier than adjusting the TTL value of each multicast sender. The only real downside to this is that it scales poorly with the number of routers and it affects all multicast traversing the router's interfaces.

Administrative scoping (RFC2365)

This is one of the current best practices, defining boundaries for sets of multicast groups instead of limiting all multicast (as TTL scoping does). In the case of smcrouted this is left to the administrator to manage. See mrouted(8), and mrouted.conf(5), for more details.

Filtering

Some sort of filtering mechanism, e.g., firewall (Linux netfilter) or low-level filter (Linux tc or eBPF) that may even have some hardware offloading support (TCAM). The firewall is likely the most common since it is also often used to set up SNAT or 1:1 NAT (Linux netmap).

### Multicast Routes
A multicast route is defined by an input interface IFNAME, the sender's unicast IP address SOURCE, which is optional, the multicast group GROUP and a list of, at least one, output interface IFNAME [IFNAME ...].

```
mroute from eth0                  group 225.1.2.3  to eth1 eth2
mroute from eth0 source 1.2.3.4   group 225.3.2.1  to eth1 eth2

mroute from eth0                  group  ff2e::42  to eth1 eth2
mroute from eth0 source 2001:3::1 group  ff2e::43  to eth1 eth2
```

The sender address and multicast group must both be either IPv4 or IPv6 addresses.

The output interfaces are not needed when removing routes using the smcroutectl remove command. The first three parameters are sufficient to identify the source of the multicast route.

The intended purpose of smcrouted is to aid in situations where dynamic multicast routing does not work properly. However, a dynamic multicast routing protocol is in nearly all cases the preferred solution. The reason for this is their ability to translate Layer-3 signaling to Layer-2 and vice versa (IGMP or MLD).

Note: the optional source address multicast routes are not installed in the kernel multicast forwarding cache (MFC) by smcrouted. Instead, it dynamically installs new routes to the kernel MFC, matching the group and inbound interface, when the kernel notifies smcrouted using "upcalls" called NOCACHE messages. This feature was grafted onto smcrouted from mrouted(8), and may not work as intended in all use-cases.

### Multicast Groups
smcrouted is capable of simple group join and leave by sending commands to the kernel. The kernel then handles sending Layer-2 IGMP/MLD join and leave frames as needed. This can be used for testing but is also useful sometimes to open up multicast from the sender if located on a LAN with switches equipped with IGMP/MLD Snooping. Such devices will prevent forwarding of multicast unless an IGMP/MLD capable router or multicast client is located on the same physical port as you run smcrouted on. However, this feature of smcrouted is only intended as a workaround. Some platforms impose a limit on the maximum number of groups that can be joined, some of these systems can be tuned to increase this limit. For bigger installations it is strongly recommended to instead address the root cause, e.g. enable multicast router ports on intermediate switches, either statically or by enabling the multicast router discovery feature of smcrouted.

To emulate a multicast client using smcrouted you use the join and leave commands to issue join and leave commands for a given multicast group on a given interface IFNAME. The GROUP may be given in an IPv4 or IPv6 address format.

The command is passed to the daemon that passes it to the kernel. The kernel then tries to join the multicast group GROUP on interface IFNAME by starting IGMP, or MLD for IPv6 group address, signaling on the given interface. This signaling may be received by routers/switches connected on that network supporting IGMP/MLD multicast signaling and, in turn, start forwarding the requested multicast stream eventually reach your desired interface.

### Multiple Daemon Instances
When running multiple smcrouted instances, using the -t ID command line flag, one per routing table on Linux, it is required to use the -i NAME option to both daemon and client. This because the name of the IPC socket used for communicating is composed from the identity.

## DEBUGGING
The most common problem when attempting to route multicast is the TTL. Always start by verifying that the TTL of your multicast stream is not set to 1, because the router decrements the TTL of an IP frame before routing it. Test your setup using ping(8) or iperf(1). Either of which is capable of creating multicast traffic with an adjustable TTL. Iperf in particular is useful since it can act both as a multicast source (sender) and a multicast sink (receiver). For more advanced IP multicast testing the mcjoin(1) tool can be used.

### Note
A lot of extra information is sent under the daemon facility and the debug priority to the syslog daemon. Use ‘smcrouted -s -l debug’ to enable.

## SIGNALS
For convenience in sending signals, smcrouted writes its process ID to /var/run/smcroute.pid upon startup, unless the -p FILE or -i NAME options are used to change the identity or file name used. The following signals are supported:

HUP

Tell smcrouted to reload its configuration file and activate the changes.

INT

Terminates execution gracefully.

TERM

The same as INT.

## FILES
/etc/smcroute.conf

Optional configuration file for smcrouted. Defined interfaces to use, groups to join, and routes to set when starting, or reloading smcrouted on SIGHUP. Like the PID file, the name of the configuration file may be different depending on command line options given to the daemon. Most notably, -I IDENT defines the full suite of files used by the smcrouted daemon. See smcroute.conf(5) for details.

/etc/smcroute.d/*.conf

Optional configuration directory, path defined by convention only, actual configuration directory, or file(s) to include, defined by /etc/smcroute.conf. See smcroute.conf(5) for details.

/var/run/smcroute.pid

Default PID file (re)created by smcrouted when it has started up and is ready to receive commands. See also the -i NAME or -P FILE options which can change the default name.

/var/run/smcroute.sock

IPC socket created by smcrouted for use by smcroutectl. Same caveats apply to this file as the previous two, command line options -i NAME and -S FILE to the daemon can be used to change the socket file name.

/proc/net/ip_mr_cache

Linux specific, holds active IPv4 multicast routes.

/proc/net/ip_mr_vif

Linux specific, holds the IPv4 virtual interfaces used by the active multicast routing daemon.

/proc/net/ip6_mr_cache

Linux specific, holds active IPv6 multicast routes.

/proc/net/ip6_mr_vif

Linux specific, holds the IPv6 virtual interfaces used by the active multicast routing daemon.

/proc/net/igmp

Linux specific, holds active IGMP ASM (*,G) joins.

/proc/net/igmp6

Linux specific, holds active MLD ASM (*,G) joins.

/proc/net/mcfilter

Linux specific, holds active IGMP SSM (S,G) joins.

/proc/net/mcfilter6

Linux specific, holds active MLD SSM (S,G) joins.

/proc/sys/net/ipv4/igmp_max_memberships

Linux specific tuning of max IGMP ASM (*,G) per socket, default 20.

/proc/sys/net/ipv4/igmp_max_msf

Linux specific tuning of max IGMP SSM (S,G) per socket, default 10.

BSD systems may consult the netstat(1) tool for stats on virtual multicast interface tables and multicast forwarding caches, and VIF/MIF allocation, as well as the ifmcstat(8) tool for querying group membership.

## EXIT STATUS
smcrouted leverages BSD sysexits.h exit codes (64-78), which process supervisors like systemd(1) and finit(8) understands. The following table details what codes are used for and how to interpret them.

Status

Symbolic Name

Description

0

EX_OK

Success

64

EX_USAGE

Invalid command line option, or missing argument

69

EX_UNAVAILABLE

Multicast routing socket (or table) already in use

79

EX_SOFTWARE

Internal error, bug in smcrouted

71

EX_OSERR

Failed fork(), daemon(), getifaddrs(), malloc(), etc.

76

EX_PROTOCOL

Kernel does not seem to support multicast routing

77

EX_NOPERM

Not enough permissions to run

78

EX_CONFIG

Parse error in configuration file

## SEE ALSO
smcroute.conf(5), smcroutectl(8), mrouted(8), pimd(8), pim6sd(8), ping(8), mcjoin(1), iperf(1)

## AUTHORS
SMCRoute was originally created by Carsten Schill <carsten@cschill.de>. Initial IPv6 support by Todd Hayton <todd.hayton@gmail.com>. Initial FreeBSD support by Micha Lenk <micha@debian.org>.

SMCRoute is currently maintained by Joachim Wiberg <troglobit@gmail.com>, and Micha Lenk <micha@debian.org> at GitHub.


smem

package: smem

title: smem(8)

text:
# smem(8)

## NAME
smem - Report memory usage with shared memory divided proportionally.

## SYNOPSIS
smem [options]

## DESCRIPTION
smem reports physical memory usage, taking shared memory pages into account. Unshared memory is reported as the USS (Unique Set Size). Shared memory is divided evenly among the processes sharing that memory. The unshared memory (USS) plus a process's proportion of shared memory is reported as the PSS (Proportional Set Size). The USS and PSS only include physical memory usage. They do not include memory that has been swapped out to disk.

Memory can be reported by process, by user, by mapping, or systemwide. Both text mode and graphical output are available.

## OPTIONS

### GENERAL OPTIONS
-h, --help

Show help.

### SOURCE DATA
By default, smem will pull most of the data it needs from the /proc filesystem of the system it is running on. The --source option lets you used a tarred set of /proc data saved earlier, possibly on a different machine. The --kernel and --realmem options let you specify a couple things that smem cannot discover on its own.

-K KERNEL, --kernel=KERNEL

Path to an uncompressed kernel image. This lets smem include the size of the kernel's code and statically allocated data in the systemwide (-w) output. (To obtain an uncompressed image of a kernel on disk, you may need to build the kernel yourself, then locate file vmlinux in the source tree.)

-R REALMEM, --realmem=REALMEM

Amount of physical RAM. This lets smem detect the amount of memory used by firmware/hardware in the systemwide (-w) output. If provided, it will also be used as the total memory size to base percentages on. Example: --realmem=1024M

-S SOURCE, --source=SOURCE

/proc data source. This lets you specify an alternate source of the /proc data. For example, you can capture data from an embedded system using smemcap, and parse the data later on a different machine. If the --source option is not included, smem reports memory usage on the running system.

### REPORT BY
If none of the following options are included, smem reports memory usage by process.

-m, --mappings

Report memory usage by mapping.

-u, --users

Report memory usage by user.

-w, --system

Report systemwide memory usage summary.

### FILTER BY
If none of these options are included, memory usage is reported for all processes, users, or mappings. (Note: If you are running as a non-root user, and if you are not using the --source options, then you will only see data from processes whose /proc/ information you have access to.)

-M MAPFILTER, --mapfilter=MAPFILTER

Mapping filter regular expression.

-P PROCESSFILTER, --processfilter=PROCESSFILTER

Process filter regular expression.

-U USERFILTER, --userfilter=USERFILTER

User filter regular expression.

### OUTPUT FORMATTING
-a, --autosize

Size columns to fit terminal size.

-c COLUMNS, --columns=COLUMNS

Columns to show.

-H, --no-header

Disable header line.

-k, --abbreviate

Show unit suffixes.

-n, --numeric

Show numeric user IDs instead of usernames.

-p, --percent

Show percentages.

-r, --reverse

Reverse sort.

-s SORT, --sort=SORT

Field to sort on.

-t, --totals

Show totals.

### OUTPUT TYPE
These options specify graphical output styles.

--bar=BAR

Show bar graph.

--pie=PIE

Show pie graph.

## REQUIREMENTS
smem requires:

- Linux kernel providing 'Pss' metric in /proc/<pid>/smaps (generally 2.6.27 or newer).

- Python 2.x (at least 2.4 or so).

- The matplotlib library (only if you want to generate graphical charts).

## EMBEDDED USAGE
To capture memory statistics on resource-constrained systems, the the smem source includes a utility named smemcap. smemcap captures all /proc entries required by smem and outputs them as an uncompressed .tar file to STDOUT. smem can analyze the output using the --source option. smemcap is small and does not require Python.

To use smemcap:

1.

Obtain the smem source at http://selenic.com/repo/smem

2.

Compile smemcap.c for your target system.

3.

Run smemcap on the target system and save the output:

smemcap > memorycapture.tar

4.

Copy the output to another machine and run smem on it:

smem -S memorycapture.tar

## FILES
/proc/$pid/cmdline

/proc/$pid/smaps

/proc/$pid/stat

/proc/meminfo

/proc/version

## RESOURCES
Main Web Site: http://www.selenic.com/smem

Source code repository: http://selenic.com/repo/smem

Mailing list: http://selenic.com/mailman/listinfo/smem

## SEE ALSO
free(1), pmap(1), proc(5), ps(1), top(1), vmstat(8)

## COPYING
Copyright (C) 2008-2009 Matt Mackall. Free use of this software is granted under the terms of the GNU General Public License version 2 or later.

## AUTHOR
smem was written by Matt Mackall.


snap-confine

package: snap-confine

title: snap-confine(8)

text:
# snap-confine(8)

## NAME
snap-confine - internal tool for confining snappy applications

## SYNOPSIS
snap-confine [--classic] [--base BASE] SECURITY_TAG COMMAND [...ARGUMENTS]

## DESCRIPTION
The snap-confine is a program used internally by snapd to construct the execution environment for snap applications.

## OPTIONS
The snap-confine program accepts two options:

--classic requests the so-called _classic_ _confinement_ in which applications are not confined at all (like in classic systems, hence the name). This disables the use of a dedicated, per-snap mount namespace. The snapd service generates permissive apparmor and seccomp profiles that allow everything. --base BASE directs snap-confine to use the given base snap as the root filesystem. If omitted it defaults to the core snap. This is derived from snap meta-data by snapd when starting the application process.

## FEATURES

### Apparmor profiles
snap-confine switches to the apparmor profile $SECURITY_TAG. The profile is mandatory and snap-confine will refuse to run without it.

The profile has to be loaded into the kernel prior to using snap-confine. Typically this is arranged for by snapd. The profile contains rich description of what the application process is allowed to do, this includes system calls, file paths, access patterns, linux capabilities, etc. The apparmor profile can also do extensive dbus mediation. Refer to apparmor documentation for more details.

### Seccomp profiles
snap-confine looks for the /var/lib/snapd/seccomp/bpf/$SECURITY_TAG.bin file. This file is mandatory and snap-confine will refuse to run without it. This file contains the seccomp bpf binary program that is loaded into the kernel by snap-confine.

The file is generated with the /usr/lib/snapd/snap-seccomp compiler from the $SECURITY_TAG.src file that uses a custom syntax that describes the set of allowed system calls and optionally their arguments. The profile is then used to confine the started application.

As a security precaution disallowed system calls cause the started application executable to be killed by the kernel. In the future this restriction may be lifted to return EPERM instead.

### Mount profiles
snap-confine uses a helper process, snap-update-ns, to apply the mount namespace profile to freshly constructed mount namespace. That tool looks for the /var/lib/snapd/mount/snap.$SNAP_NAME.fstab file. If present it is read, parsed and treated like a mostly-typical fstab(5) file. The mount directives listed there are executed in order. All directives must succeed as any failure will abort execution.

By default all mount entries start with the following flags: bind, ro, nodev, nosuid. Some of those flags can be reversed by an appropriate option (e.g. rw can cause the mount point to be writable).

Certain additional features are enabled and conveyed through the use of mount options prefixed with x-snapd-.

As a security precaution only bind mounts are supported at this time.

### Sharing of the mount namespace
As of version 1.0.41 all the applications from the same snap will share the same mount namespace. Applications from different snaps continue to use separate mount namespaces.

## ENVIRONMENT
snap-confine responds to the following environment variables

SNAP_CONFINE_DEBUG:

When defined the program will print additional diagnostic information about the actions being performed. All the output goes to stderr.

The following variables are only used when snap-confine is not setuid root. This is only applicable when testing the program itself.

SNAPPY_LAUNCHER_INSIDE_TESTS:

Internal variable that should not be relied upon.

SNAPPY_LAUNCHER_SECCOMP_PROFILE_DIR:

Internal variable that should not be relied upon.

SNAP_USER_DATA:

Full path to the directory like /home/$LOGNAME/snap/$SNAP_NAME/$SNAP_REVISION. This directory is created by snap-confine on startup. This is a temporary feature that will be merged into snapd's snap-run command. The set of directories that can be created is confined with apparmor.

## FILES
snap-confine and snap-update-ns use the following files:

/var/lib/snapd/mount/snap.*.fstab:

Description of the mount profile.

/var/lib/snapd/seccomp/bpf/*.src:

Input for the /usr/lib/snapd/snap-seccomp profile compiler.

/var/lib/snapd/seccomp/bpf/*.bin:

Compiled seccomp bpf profile programs.

/run/snapd/ns/:

Directory used to keep shared mount namespaces. snap-confine internally converts this directory to a private bind mount. Semantically the behavior is identical to the following mount commands:

mount --bind /run/snapd/ns /run/snapd/ns mount --make-private /run/snapd/ns

/run/snapd/ns/.lock:

A flock(2)-based lock file acquired to create and convert /run/snapd/ns/ to a private bind mount.

/run/snapd/ns/$SNAP_NAME.lock:

A flock(2)-based lock file acquired to create or join the mount namespace represented as /run/snaps/ns/$SNAP_NAME.mnt.

/run/snapd/ns/$SNAP_NAME.mnt:

This file can be either:

- An empty file that may be seen before the mount namespace is preserved or when the mount namespace is unmounted.

- A file belonging to the nsfs file system, representing a fully populated mount namespace of a given snap. The file is bind mounted from /proc/self/ns/mnt from the first process in any snap.

/proc/self/mountinfo:

This file is read to decide if /run/snapd/ns/ needs to be created and converted to a private bind mount, as described above.

Note that the apparmor profile is external to snap-confine and is loaded directly into the kernel. The actual apparmor profile is managed by snapd.

## BUGS
Please report all bugs with https://bugs.launchpad.net/snapd/+filebug

## AUTHOR
zygmunt.krynicki@canonical.com

## COPYRIGHT
Canonical Ltd.


snap-discard-ns

title: snap-discard-ns(8)

text:
# snap-discard-ns(8)

## NAME
snap-discard-ns - internal tool for discarding preserved namespaces of snappy applications

## SYNOPSIS
snap-discard-ns [--from-snap-confine] SNAP_INSTANCE_NAME

## DESCRIPTION
The snap-discard-ns is a program used internally by snapd to discard a preserved mount namespace of a particular snap.

## OPTIONS
The --from-snap-confine option is used internally by snap-confine to tell snap-discard-ns that it is invoked from snap-confine and can disable locking.

## ENVIRONMENT
snap-discard-ns responds to the following environment variables

SNAP_CONFINE_DEBUG:

When defined the program will print additional diagnostic information about the actions being performed. All the output goes to stderr.

## FILES
snap-discard-ns uses the following files:

/run/snapd/ns/$SNAP_INSTNACE_NAME.mnt: /run/snapd/ns/$SNAP_INSTNACE_NAME.*.mnt:

The preserved mount namespace that is unmounted and removed by snap-discard-ns. The second form is for the per-user mount namespace.

/run/snapd/ns/snap.$SNAP_INSTNACE_NAME.fstab: /run/snapd/ns/snap.$SNAP_INSTNACE_NAME.*.user-fstab:

The current mount profile of a preserved mount namespace that is removed by snap-discard-ns.

## BUGS
Please report all bugs with https://bugs.launchpad.net/snapd/+filebug

## AUTHOR
zygmunt.krynicki@canonical.com

## COPYRIGHT
Canonical Ltd.