Linux Basics: User identity and Process permissions

First, the basic concept

Permissions :

Defines the user's ability to access resources.

User :

for multi-user multitasking Linux operating system, what is the difference between different users? User: The user is the credential that gets the resource or service. When we log in to the system, the system will prompt for user name and password for login verification. For Linux systems, a user is usually an identity, represented by a UID .

Process :

the process of executing the program. The so-called operation of a computer, such as double-clicking an application icon or typing a command from a command prompt, results in the creation of a process. What appears to be a user's operation is actually a process that is done instead of us, and the process is the agent of our access to the computer resources .

For example: Opening word is creating a WINWORD.EXE process.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5B/90/wKioL1UMUXmRzH0qAAHuG8qxm5M781.jpg "style=" float: none; "title=" 1.png "alt=" Wkiol1umuxmrzh0qaahug8qxm5m781.jpg "/>

Executing the tail-f command is to create a tail process.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5B/96/wKiom1UMUEzhTr1OAAC2odijv-I529.jpg "style=" float: none; "title=" 3.png "alt=" Wkiom1umuezhtr1oaac2odijv-i529.jpg "/>

Process Permissions :

When we need access to resources, we must give the appropriate process permission. This means that the process must carry the identity information of the user initiating the process, which is also owned by the host and the group.

when Linux finishes booting, the INIT process executes a login child process. We pass the user name and password to the login child process. After querying the /etc/passwd and /etc/shadowanddetermining its legitimacy, login runs (using EXEC) a shell process, The shell process valid identity is set as the user's identity. Because the child processes that fork this shell process thereafter inherit valid identities.

citing the Advanced programming in the UNIX environment-second Edition "

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5B/96/wKiom1UMTuWiiki8AATrNMCD_Wc568.jpg "title=" 2.png " alt= "Wkiom1umtuwiiki8aatrnmcd_wc568.jpg"/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5B/96/wKiom1UMUN-i8-mXAAFTucYgkck056.jpg "style=" float: none; "title=" 1.png "alt=" Wkiom1umun-i8-mxaaftucygkck056.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/5B/90/wKioL1UMUgzhiWDWAATi53GgEus228.jpg "style=" float: none; "title=" 2.png "alt=" Wkiol1umugzhiwdwaati53ggeus228.jpg "/>

Ii. mechanism of the Linux creation process

Pre-knowledge

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5B/96/wKiom1UMU5CzuSywAAIFgbsUbF4784.jpg "title=" 2.png " alt= "Wkiom1umu5czusywaaifgbsubf4784.jpg"/>

  In fact, when the computer is powered on, the kernel (kernel) only establishes a init the process. Linux kernel does not provide a system call to create a new process directly. All remaining processes are the INIT process through fork mechanism is established. The new process has to replicate itself through the old process, which is the fork. Fork is a system call. The process survives in memory. Each process allocates its own piece of space in memory (address space). When the process is fork, Linux opens up a new memory space in memory to the new process, and copies the contents of the old process space into the new space, after which two processes run concurrently.

The old process becomes the parent process of thenew process, and, accordingly, the new process is the child process of the old process. A process In addition to a PID, there will also be a ppid (parent PID) to store the parent process PID. If we follow the ppid, we will always find that its source is the init process. Therefore, all processes also constitute a tree-like structure with the root of init.

First step: Fork (): Copy process image

Step two: EXEC series functions: replacing process images

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5B/96/wKiom1UMUryg18juAACLjPqvVVo521.jpg "title=" 1.png " alt= "Wkiom1umuryg18juaacljpqvvvo521.jpg"/>

Third, the execution mechanism of external command

The external command is the command executed by the shell copy (the new process), and the basic process is as follows:
A. Shell through Fork () To create a new process. This process is a copy of the current shell.
b. In the new process, in the path In the directory listed in the variable, look for a specific command.
  The path lookup step is skipped when the command name contains a slash (/) symbol.
c. In the new process, through   exec series function to replace the shell process in progress with the found new program and execute it.
D. After the child process exits, the original shell will then read the next command from the terminal and execute the next command in the script.

Suppose we execute the Cat a.txt command in the shell, and the process can be described as follows:

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5B/96/wKiom1UMV1Px4ZpzAAEbSQQurRU807.jpg "title=" 1.png " alt= "Wkiom1umv1px4zpzaaebsqqurru807.jpg"/>

In combination with the above access, let's analyze the whole process.

Use the Ls-l command to view the permissions for a file.

[Email protected] ~]$ iduid=500 (SKYPEGNU) gid=500 (SKYPEGNU) groups=500 (SKYPEGNU) Context=unconfined_u:unconfined_r: Unconfined_t:s0-s0:c0.c1023[[email protected] ~]$ ls-l/bin/cat-rwxr-xr-x. 1 root root 45224 Nov 2013/bin/cat[[email protected] ~]$ ls-l a.txt-rw-rw-r--. 1 Skypegnu skypegnu 7259 Mar 01:31 a.txt

We can see that the SKYPEGNU user real UID, real GID is 500.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5B/90/wKioL1UMXEyAfWOiAABWPfY1vBI408.jpg "title=" 1.png " alt= "Wkiol1umxeyafwoiaabwpfy1vbi408.jpg"/>

When we execute a process,Effective user ID of the processEqualsReal User ID,Effective group ID of the processEqualsReal Group ID。Euid of the cat processEqualsID of the a.txt file owner, so the cat process owns the file'srw-Permissions, then it is natural to have access to the contents of the A.txt file.

Cat process Skypegnu Skypegnua.txt-rw-rw-r--. Skypegnu Skypegnu

This article is from the "Share Your Knowledge" blog, so be sure to keep this source http://skypegnu1.blog.51cto.com/8991766/1622707

Linux Basics: User identity and Process permissions