11

I'm simply curious as to why man has its own user.

$ grep man /etc/passwd man:x:6:12:man:/var/cache/man:/usr/sbin/nologin 

I'm using Debian Buster.

3
  • 2
    man pages and man cache owned by man means you can use various user accounting tools and see how much disk space is used by man pages - for example Commented Nov 23, 2021 at 2:12
  • 1
    @Bravo are man pages owned by man on your system? Commented Nov 23, 2021 at 5:41
  • @StephenKitt - no, but /var/cache/man is - interesting, never noticed that Commented Nov 23, 2021 at 6:34

1 Answer 1

20

man (at least, the version implemented in man-db) can be set up with its own user so that its “cache” (which includes indexes, as used e.g. by whatis) can be owned and updated by that user (instead of root).

Additionally, man can be setuid to that user, allowing it to write to its cache directory without requiring specific permissions for users:

$ ls -ld /var/cache/man /usr/bin/man -rwsr-sr-x 1 man man 115600 Feb 19 2021 /usr/bin/man drwxr-xr-x 31 man man 4096 Nov 23 00:00 /var/cache/man 

The above shows that the man binary is setuid and setgid man, and man owns /var/cache/man.

In Debian derivatives this can be configured with sudo dpkg-reconfigure man-db. The explanation given there is

The man and mandb program can be installed with the set-user-id bit set, so that they will run with the permissions of the 'man' user. This allows ordinary users to benefit from the caching of preformatted manual pages ('cat pages'), which may aid performance on slower machines.

Cached man pages only work if you are using an 80-column terminal, to avoid one user causing cat pages to be saved at widths that would be inconvenient for other users. If you use a wide terminal, you can force man pages to be formatted to 80 columns anyway by setting MANWIDTH=80.

Enabling this feature may be a security risk, so it is disabled by default. If in doubt, you should leave it disabled.

“cat pages” aren’t useful nowadays, so configuring a system without support for them won’t cause any issues. It is also possible to support cat pages without allowing their creation by arbitrary users, and thus requiring a man user and setuid binary; various Unix systems used to be set up so that they would periodically generate all missing cat pages (see catman).

Even without a setuid man, a man user can be useful for man-related cron jobs (whatis indexes etc.).

6
  • Thank you,, Stephen. How about on systems that don't have /var/cache/man? (BSD,OSX) Commented Nov 23, 2021 at 6:18
  • @Jim do they have a man user? I don’t see one in OpenBSD, I don’t have access to a Mac to check there. Commented Nov 23, 2021 at 6:39
  • You're right, my OSX machine doesn't, but FreeBSD does, UID 9 man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin Commented Nov 23, 2021 at 7:01
  • @Jim in FreeBSD, the man user was used for catman; I don’t know whether it’s still useful nowadays. (System users tend to linger long after they cease being relevant, to avoid id re-use and ensure that old files on upgraded systems still have a meaningful owner.) Commented Nov 23, 2021 at 7:23
  • 1
    @StephenKitt: Finally an explanation why a user where I would have used a group. Commented Nov 23, 2021 at 15:38

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.