Process UID and GID
In order for the operating system to know what a process is allowed to do it must store information about who owns the process (UID and GID). The UNIX operating system stores two types of UID and two types of GID.
Real UID and GID
A process' real UID and GID will be the same as the UID and GID of the user who ran the process. Therefore any process you execute will have your UID and GID.
The real UID and GID are used for accounting purposes.
Effective UID and GID
The effective UID and GID are used to determine what operations a process can perform. In most cases the effective UID and GID will be the same as the real UID and GID.
However using special file permissions it is possible to change the effective UID and GID. How and why you would want to do this is examined later in this chapter. The following exercise asks you to create an executable program we will use to display the real and effective UID and GID.
Effective UID and GID
In this section we revisit the discussion of the relationship between the process attributes of real UID/GID and effective UID/GID.
When you use the passwd command to change your password the command will actually change the contents of either the /etc/passwd or /etc/shadow files. These are the files where your password is stored. By default most Linux systems use /etc/passwd
As has been mentioned previously the UNIX operating system uses the effective UID and GID of a process to decide whether or not that process can modify a file. Also the effective UID and GID are normally the UID and GID of the user who executes the process.
This means that if I use the passwd command to modify the contents of the /etc/passwd file (I write to the file) then I must have write permission on the /etc/passwd file. Let's find out.
What are the file permissions on the /etc/passwd file?
dinbig:~$ ls -l /etc/passwd
-rw-r--r-- 1 root root 697 Feb 1 21:21 /etc/passwd
On the basis of these permissions should I be able to write to the /etc/passwd file?
No. Only the user who owns the file, root, has write permission. Then how do does the passwd command change my password?
setuid and setgid
This is where the setuid and setgid file permissions enter the picture. Let's have a look at the permissions for the passwd command (first we find out where it is).
dinbig:~$ which passwd
/usr/bin/passwd
dinbig:~$ ls -l /usr/bin/passwd
-rws--x--x 1 root bin 7192 Oct 16 06:10 /usr/bin/passwd
Notice the s symbol in the file permissions of the passwd command, this specifies that this command is setuid.
The setuid and setgid permissions are used to change the effective UID and GID of a process. When I execute the passwd command a new process is created. The real UID and GID of this process will match my UID and GID. However the effective UID and GID (the values used to check file permissions) will be set to that of the command.
In the case of the passwd command the effective UID will be that of root because the setuid permission is set, while the effective GID will be my group's because the setgid bit is not set.