1

Each process has three user IDs:

  • Real user ID (ruid).
  • Effective user ID (euid).
  • Saved user ID (suid).

Similarly, a process has three group IDs:

  • Real group ID (rgid).
  • Effective group ID (egid).
  • Saved group ID (sgid).

Based on my understanding, the euid is used when accessing a file to match it with the owner of the file.

But I am not sure about the egid. Is the egid also used when accessing a file to match it with the group of the file? If so, then shouldn't each process have many effective groups IDs since each user can belong to many groups?

3

There is one egid. However! At least in BSDlandia (and copied by Linux; not sure what SysV does here) there is the setgroups(2) call

DESCRIPTION
     setgroups() sets the group access list of the current user process
     according to the array gidset.  The parameter ngroups indicates the
     number of entries in the array and must be no more than {NGROUPS_MAX}.

     Only the superuser may set new groups.

and getgroups(2) to retrieve that list.

Some programs notably drop the supplemental group list e.g. httpd on OpenBSD in src/usr.sbin/httpd/proc.c

    if (setgroups(1, &pw->pw_gid) ||
        setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
        setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
            fatal("%s: cannot drop privileges", __func__);

which may be surprising if you were expecting those supplemental groups to be around.

NGROUPS_MAX is another fun limit, especially involving NFS and folks in lots of groups, though there are now ways around that (besides the old way of not adding a user to more than the typical 16 groups).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.