Filter
Top Products
5.2.2.2.4 setresuid()and setresgid()
These set the real user and group ID, the effective user and group ID, and the saved set-user and group ID of
the current process. Normal user processes (that is, processes with real, effective, and saved user IDs that are
nonzero) may change the real, effective, and saved user and group IDs to either the current uid and gid, the
current effective uid and gid, or the current saved uid and gid. An administrator can set the real, effective,
and saved user and group ID to an arbitrary value.
5.2.2.3 execve()
This invokes the exec_mmap() function to release the memory descriptor, all memory regions, and all page
frames assigned to the process, and to clean up the Page Tables of a process. The execve() function
invokes the do_mmap() function twice, first to create a new memory region that maps the text segment of
the executable, and then to create a new memory region that maps the data segment of the executable file.
The object reuse requirement is satisfied because memory region allocation follows the demand paging
technique described in Section 5.5.
execve() can also alter the credentials of the process if the setuid bit of the executable file is set. If the
setuid bit is set, the current euid and fsuid of the process are set to the identifier of the owner of the file. This
change of credentials affects process permissions for the DAC policy.
5.2.2.4 do_exit()
Process termination is handled in the kernel by the do_exit() function. The do_exit() function
removes most references to the terminating process from the kernel data structures and releases resources,
such as memory, open files, and semaphores held by the process.
5.2.3 Process switch
To control the execution of multiple processes, the SLES kernel suspends the execution of the process
currently running on the CPU and resumes the execution of some other process previously suspended. In
performing a process switch, the SLES kernel ensures that each register is loaded with the value it had when
the process was suspended. The set of data that must be loaded into registers is called the hardware context,
which is part of the larger process execution context. Part of the hardware context is contained in the task
structure of a process; the rest is saved in the kernel mode stack of a process, which allows for the separation
needed for a clean switch. In a three-step process, the switch is performed by:
1. installation of a new address space
2. switching the Kernel Mode Stack
3. switching the hardware context
5.2.4 Kernel threads
The SLES kernel delegates certain critical system tasks, such as flushing disk caches, swapping out unused
page frames, and servicing network connections, to kernel threads. Because kernel threads execute only in
kernel mode, they do not have to worry about credentials. Kernel threads satisfy the object reuse requirement
by allocating memory from the kernel memory pool, as described in the kernel memory management section
of this document.
58