lib/daemon: support --user option for all OVS daemon

[cascardo/ovs.git] / lib / daemon.man

diff --git a/lib/daemon.man b/lib/daemon.man
index 4ab9823..039a0c4 100644 (file)
--- a/lib/daemon.man
+++ b/lib/daemon.man
@@ -50,3 +50,18 @@ core dumps into the current working directory and the root directory
 is not a good directory to use.
 .IP
 This option has no effect when \fB\-\-detach\fR is not specified.
+.
+.TP
+\fB\-\-user\fR
+Causes \fB\*(PN\fR to run as a non root user specified in "user:group", thus
+dropping all root privileges. Short forms "user" and ":group" are also
+allowed, with current user or group are assumed respectively. Only daemons
+started by the root user accepts this argument.
+.IP
+On Linux, daemons will be granted CAP_IPC_LOCK and CAP_NET_BIND_SERVICES
+before dropping root privileges. Daemons interact with datapath,
+such as ovs-vswitchd, will be granted two additional capabilities, namely
+CAP_NET_ADMIN and CAP_NET_RAW.
+.IP
+On Windows, this option is not currently supported. For security reasons,
+specifying this option will cause the daemon process not to start.