3

The "effecive user/group ID" of a process is what the OS uses to determine whether an action (such as opening a file) is permitted by the process. You can set the effective primary GID of the current process using setegid, which can only be used by superusers (or if given the capability) to lower privileges temporarily.

Supplementary GIDs are additional groups that are also used to check if an action is permitted by a process. For example, if a file is located under a directory structure /A/B/C/file.txt, and directories A, B, and C have read-access locked to their owners groupA, groupB, groupC respectively, the process would need all 3 groups in their supplementary groups or effective GID.

There is a setgroups syscall which is analogous to setgid, meaning it changes the environment of the process permanently. Is there no need for an "effective" syscall of supplementary groups (i.e. setegroups)?

1

Such system call doesn't exist because the supplementary groups can be considered to be themselves the effective groups.

The difference between real and effective UID and GIDs exists to allow processes to drop privileges, but also to allow users to raise the privileges with which some processes are called (via the setuid/setgid filesystem bits). In both cases we want to keep track of the real UID and GID of the user behind the process with the raised/lowered privileges (effective UID and GID).

There is no need for that difference for supplementary groups because those can easily be recovered from the groups file.

Note that, when raising or dropping privileges, an application would typically call initgroups to reset the groups to match the effective uid and gid of the new user (thus losing access to any other supplementary groups that could previously be in place).

From another source:

"The only use of setgroups is usually from the initgroups function, which reads the entire group file with the functions getgrent, setgrent, and endgrent, which we described earlier and determines the group membership for username. It then calls setgroups to initialize the supplementary group ID list for the user. One must be superuser to call initgroups, since it calls setgroups.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.