S6-SUDOC(8)

💅 S6-SUDOC(8) 💅

okay so bestie, welcome to s6-sudoc — a page from the System Manager's Manual, and honestly? it's giving "tiny tool, big responsibilities." let's get into it 🫶

---

✨ NAME ✨

s6-sudoc — the way you talk to a peer s6-sudod(8) program over a Unix socket, passing it command-line arguments, environment variables and standard descriptors 💌

---

🌸 SYNOPSIS 🌸

s6-sudoc [-e] [-t timeoutconn] [-T timeoutrun] [args...]

---

🦋 DESCRIPTION 🦋

so here's the vibe. s6-sudoc transmits its standard input, standard output and standard error via fd-passing over a Unix socket that must be open on its descriptors 6 and 7. it fully expects an s6-sudod(8) process to be on the other side receiving them, like a little handoff 🤝

it also transmits its command-line arguments args..., and also its environment by default. but heads up — s6-sudod(8) will not necessarily accept all the environment variables that s6-sudoc tries to transmit. no cap, some of them just don't make the cut 🙈

then s6-sudoc waits for the server program run by s6-sudod(8) to finish. it exits with the same exit code as the server program. and if the server program is killed by a signal, s6-sudoc kills itself with the same signal. matching energy, periodt 💀

⚠️ okay this next part is the serious bit, so listen up. if s6-sudoc is killed, or exits after timeoutrun milliseconds, while the server program is still running, s6-sudod(8) will send a SIGTERM and a SIGCONT to the server program — but this does not guarantee that it will die. if the server program keeps running, it might still read from the file that was s6-sudoc's stdin, or write to the files that were s6-sudoc's stdout or stderr. this is a potential security risk 😭 administrators should audit their server programs to make sure this does not happen. fr fr, go check.

more generally, anything using signals or terminals will not be handled transparently by the s6-sudoc + s6-sudod(8) mechanism. the mechanism was designed to allow programs to gain privileges in specific situations: short-lived, simple, noninteractive processes. it was not designed to emulate the full suid functionality, and it will not go out of its way to do so. it knows what it is and what it isn't 👑

---

🎀 OPTIONS 🎀

• -e — do not attempt to transmit any environment variables to s6-sudod(8). keeping it minimal, love that for you ✨
• -t timeoutconn — if s6-sudod(8) has not managed to process the given information and start the server program after timeoutconn milliseconds, give up. by default, timeoutconn is 0, meaning infinite. side note: there is no reason to set up a nonzero timeoutconn with a large value — s6-sudod(8) is not supposed to block, and the option is only there to protect against ill-written services 🧚
• -T timeoutrun — if the server program has not exited after timeoutrun milliseconds, give up. by default, timeoutrun is 0, meaning infinite ⏳

---

💖 SEE ALSO 💖

s6-sudo(8), s6-sudod(8)

this man page is ported from the authoritative documentation at: https://skarnet.org/software/s6/s6-sudoc.html

---

👑 AUTHORS 👑

• Laurent Bercot
• Alexis <flexibeast@gmail.com> (man page port)

---

and that's the whole page, bestie 💅 this one's from Debian, dated September 29, 2021 — so go forth responsibly, audit your server programs, and slay 🌈⭐