Linux: ps -o fuid,fuser,fgid,fgroup # what are these process filesystem access IDs used for?

Question

From the ps command's man page, what are these four "filesystem access" output-fields, specified using an -o option, used for, i.e. what does a process use them for?

fuid / fuser
fgid / fgroup

Usage example: $ ps -o fuid,fuser,fgid,fgroup.

I get that the fuid/fgid returns an ID number, and that fuser/fgroup returns a name or ID number; also that fuid/fuser have to do with a user value, and fgid/fgroup a group value.

But how do these process values relate to a 'filesystem', or what does that mean?

I'm running Debian, Buster. Thanks.

---

Disambiguation: This fuser field selector is not to be confused with the fuser command, which shows which processes are using a file.

Answer 1

These are historical artifacts, and shouldn’t be used nowadays — or rather, they shouldn’t be set to different values than the effective uid and gid. Whenever the latter change, the filesystem ids are changed to match, but the filesystem ids can be set to different values using setfsuid and setfsgid.

They serve the same role as the effective uid and gid, but only for filesystem access permission checks. Whenever the kernel checks filesystem access permissions, it doesn’t use the effective uid or gid, it uses the filesystem uid and gid. These exist for NFS servers: the latter need to change the uid and gid used to access filesystems, but this used to create a security hole because of signal handling, and filesystem uids and gids were introduced as a workaround.

The documentation linked above provides details; see also the credentials manpage.