Linux: uid/euid/suid的关系

Posted 2020-08-07 zolo®

三种进程用户的简单解释:
三种用户/组ID:
uid/gid: 实际用户/组ID
euid/egid: 有效用户/组ID, 进程执行某个应用的用户/组ID.
suid/sgid: 设置用户/组ID, 应用所属用户/组ID.

几者关系:
进程执行应用时根据euid/egid. 而euid/egid设置规则:
(euid,egid)=(suid,sgid)?(suid,sgid):(uid:gid);

注意: #!/xxx 之类的脚本无效, 因为这些脚本是通过bash或python等解释器执行的. 其在linux下类似
exec bash xxx, exec python xxxx...
所以, 设置chmod +s xxx是完全无效的, 如果要设置, 就去设置bash, python解释器的权限!

例如:
-rwx------  1 hezhaowu      hezhaowu             4 2014-05-20 09:54 hezhaowufile.txt
-rwxr-xr-x  1 hezhaowu      hezhaowu            68 2014-05-20 09:55 test

cat test
echo ‘test begin...‘
cat /tmp/hezhaowufile.txt
echo ‘test done...

设置suid前:
-rwxr-xr-x  1 hezhaowu      hezhaowu            68 2014-05-20 09:55 test
[email protected]:/tmp$ ./test
test begin...
cat: /tmp/hezhaowufile.txt: Permission denied
test done...

设置suid后:
-rwsr-sr-x  1 hezhaowu      hezhaowu            68 2014-05-20 09:55 test*

Linux下，对于脚本（包括perl，python）是忽略设置-用户/组ID位的！！！
---------------------------------------
使用测试的代码:
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>

int main() {

printf("uid=%d,euid=%d\n", getuid(), geteuid());
exit(0);

}

测试结果:
[email protected]:/tmp$ chmod u+s ctest
[email protected]:/tmp$ ll ctest
-rwsr-xr-x 1 hezhaowu hezhaowu 8622 2014-05-20 11:40 ctest*
[email protected]:/tmp$ ./ctest
uid=1007,euid=1007
[email protected]:/tmp$ ./ctest
uid=33,euid=1007
[email protected]:/tmp$ chmod u-s ctest
[email protected]:/tmp$ ll ctest
-rwxr-xr-x 1 hezhaowu hezhaowu 8622 2014-05-20 11:40 ctest*
[email protected]:/tmp$ ./ctest
uid=33,euid=33

可见, 对于exec调用的应用, suid的规则还是生效的.