At the end of the design , I came across a scene ： It needs to be called in the case of ordinary users “ privileged program ”, To access protected files . Relevant knowledge network security course , Let's recall and summarize here .
<> Effective ID And reality ID Relationship between
stay Unix In the design of , Process and multiple users ID And user groups ID Associated , Including the following ：
1, Actual user ID And actual user groups ID： Who am I , Identification of identity , Who runs the program . That is, the name of the logged in user uid and gid, Like mine Linux with simon Sign in , stay Linux The actual user who runs all the commands ID All simon of uid, Actual user group ID All simon of gid（ Can use id Command view ）.
2, Effective user ID And valid user groups ID： Processes are used to determine our access to resources , Identification of rights . Normally , Effective user ID Equal to actual user ID, Valid user groups ID Equal to actual user group ID. In the operating system , use euid Indicates a valid user id.
When set （SUID） Bit time , Valid user ID Equal to the owner of the file uid; same , If set （SGID） position , Valid user group ID Equal to the of the file owner gid. in other words , No matter which user uses the file , The file has the same name as its creator （ Often root） Permissions for .
Process RealUID and EffectiveUID And process UID Inheritance of
one . Identification of identity ： Real UID
* Process of UID Just a general term , In fact, there are many kinds UID（ruid / euid) * Process Real UID Is the identity of the process , Used to illustrate Who am I,
No real power * The permissions of the process are not determined by RealUID To decide
two . Identification of permission ： Effective UID
* You can't have identity without permission , You can do whatever you want with permission * Effective UID Is the identification of the rights of the process , Identifies the of the process “ right ” * Linux Authorization of yes by
Effective UID To identify * You can do everything you have the right * Previously explained , file , Resources and privileges API Operation authority yes adopt Effective UID To identify
three . Relationship between identity and rights
* By default Real UID == Effective UID, So use ps Command output namely Effective UID * We can also show the complete
Effective UID and Real UID
four . ROOT User privileges
* Root user , All refer to Effective UID == ROOT Process of * Without any restrictions , You can do whatever you want * ROOT Process can call setUID
Modify your own Real UID, It can also put its own Effective UID Change to ordinary UID.
five . UID Hereditary
* stay Linux In the world , For safety reasons ,UID Hereditary rule ： Identity can be hereditary , Rights cannot be hereditary * Of child processes Real UID = Effective UID, inherit
Parent process Real UID If the parent process Effective UID And Real UID dissimilarity , Does not have the rights of the parent process
six , Document setUID – Document setUID Sign and its function .
Temporarily promote the of an executable euid reach owner id, At the same time, there is no need to change its ruid. such , Ordinary users can also do some privileged behaviors .
6.1 demand ： * Linux of passwd Is an executable program , Used to modify the user's password *
passwd You need to modify the account file of multiple users （ This file can only ROOT Users can read and write ） * however Ordinary users Also change your password * passwd although
It's civilian status （ Started by ordinary users ）, But it needs the authority of the royal family ---- identity and Different rights 6.2 solve ： * Of temporary promotion process Effective UID,
And remain the same （Real UID）, So that he can take advantage of his privileges , Without passing it to the child process
Readrootfile.c The code of is as follows ：
/* * getuid() returns the real user ID of the calling process. * geteuid()
returns the effective user ID of the calling process. */ #include <stdio.h> #
include <stdlib.h> #include <sys/stat.h> #include <stdio.h> #include <fcntl.h> #
include <pwd.h> #include <grp.h> #include <ctype.h> #include <unistd.h> #include
<sys/types.h> char * get_username_by_id(uid_t uid) { struct passwd *pwd; pwd =
getpwuid(uid); return (pwd == NULL) ? NULL : pwd->pw_name; } int main(int argc,
char *argv[]) { int fd; fd = open(argv[1], O_RDWR); if(fd == -1) perror("Open
fail: "); else printf("Open %s ok.\n", argv[1]); printf("Real User ID:%d,
name=%s\n", getuid(), get_username_by_id(getuid())); /* If set Set-User-ID(chmod
u+s), that Effective User ID And Owner ID identical . */ printf("Effective User ID:%d, name=%s\n",
geteuid(), get_username_by_id(geteuid())); close(fd); return 0; }
Technology