Let's say that a process wants to issue a system call that can only be issued by a privileged process.

How does Linux knows whether to allow the process to issue such system call or not, does Linux looks at the process's fsuid (file system user ID) to see if it is a root process, or does Linux looks at the process's capabilities to see if it has the required capability to issue the system call, or does Linux knows in some other way?

  • 1
    Any process can issue any syscall, but after you trapped into kernel mode, the corresponding credentials of current thread is checked (in the kernel mode), if privilege doesn't fit, then you get -EPERM or other error value returned. As for what credentials needs to be checked, please check the manpage of that syscall. Feb 26 '19 at 14:12

Generally, the kernel looks at the process's capabilities to see if it has the required capability. You will find this information documented in the manual page of the relevant system call, which will note that "the process needs capability CAP_XYZ" in order to perform the operation. For example, looking at the manual page of kill(2), we see:

   For  a process to have permission to send a signal, it must either
   be privileged (under Linux: have the CAP_KILL  capability  in  the
   user  namespace  of  the target process), or the real or effective
   user ID of the sending process must equal the real or  saved  set-
   user-ID  of  the  target process.

Similarly in the create_module(2) page, we see:

   create_module()  attempts  to  create  a loadable module entry and
   reserve the kernel memory that will be needed to hold the  module.
   This system call requires privilege.
   EPERM  The   caller   was   not   privileged  (did  not  have  the
          CAP_SYS_MODULE capability).

The kernel is able to make these checks because capabilities are per-process attributes that the kernel records in its internal data structures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.