三种进程用户的简单解释:
三种用户/组ID:
uid/gid: 实际用户/组ID
euid/egid: 有效用户/组ID, 进程执行某个应用的用户/组ID.
suid/sgid: 设置用户/组ID, 应用所属用户/组ID.
几者关系:
进程执行应用时根据euid/egid. 而euid/egid设置规则:
(euid,egid)=(suid,sgid)?(suid,sgid):(uid:gid);
注意: #!/xxx 之类的脚本无效, 因为这些脚本是通过bash或python等解释器执行的. 其在linux下类似
exec bash xxx, exec python xxxx...
所以, 设置chmod +s xxx是完全无效的, 如果要设置, 就去设置bash, python解释器的权限!
例如:
-rwx------ 1 hezhaowu hezhaowu 4 2014-05-20 09:54 hezhaowufile.txt
-rwxr-xr-x 1 hezhaowu hezhaowu 68 2014-05-20 09:55 test
cat test
echo 'test begin...'
cat /tmp/hezhaowufile.txt
echo 'test done...
设置suid前:
-rwxr-xr-x 1 hezhaowu hezhaowu 68 2014-05-20 09:55 test
www-data@dc26:/tmp$ ./test
test begin...
cat: /tmp/hezhaowufile.txt: Permission denied
test done...
设置suid后:
-rwsr-sr-x 1 hezhaowu hezhaowu 68 2014-05-20 09:55 test*
Linux下，对于脚本（包括perl，python）是忽略设置-用户/组ID位的！！！
---------------------------------------
使用测试的代码:
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
int main() {
printf("uid=%d,euid=%d
", getuid(), geteuid());
exit(0);
}
测试结果:
hezhaowu@dc26:/tmp$ chmod u+s ctest
hezhaowu@dc26:/tmp$ ll ctest
-rwsr-xr-x 1 hezhaowu hezhaowu 8622 2014-05-20 11:40 ctest*
hezhaowu@dc26:/tmp$ ./ctest
uid=1007,euid=1007
www-data@dc26:/tmp$ ./ctest
uid=33,euid=1007
hezhaowu@dc26:/tmp$ chmod u-s ctest
hezhaowu@dc26:/tmp$ ll ctest
-rwxr-xr-x 1 hezhaowu hezhaowu 8622 2014-05-20 11:40 ctest*
www-data@dc26:/tmp$ ./ctest
uid=33,euid=33
可见, 对于exec调用的应用, suid的规则还是生效的.