Android安全模式机制之二(操作系统现代安全体系基础概念)

目录:

• 1.进程和进程边界
• 2.多用户和多用户边界
• 3.进程和文件的UID/GID (UserID/groupId)
  • 3.1文件资源的权限力度:UID/GID
  • 3.2文件的可操作权限
  • 3.3进程的标识: PID , UID , GID , GIDs
  • 3.4Name和ID的映射
  • 3.5Chmod和chown命令介绍
    • 3.5.1Chmod
    • 3.5.2Chown
• 4.UID/GID的衔接
• 5.进程的RealUID和EffectiveUID
• 6.文件的setUID标识
• 7.Capability
  • 7.1进程的Capability
  • 7.2文件的Capability
  • 7.3Capability BoundSet
  • 7.4Spawn进程的Capability

---

进程和进程边界

进程和线程
    可执行文件:不活动就是废物
    进程:可执行文件的活动表现,一次生命的历练
    线程:CPU(核)的调度单位,并发的执行序列,进程的多管齐下
    资源和调度.


进程边界的安全围栏: 
    Crash的不可扩延性
    全局数据和服务的不可访问性

多用户和多用户边界

需求背景:
    资源缺乏
    中央统一管理

多用户的边界:
    独立的工作目录
    可操作/访问的资源
        资源分类
        权限管理
    可执行的操作
        操作分类
        权限管理

多用户特性标识(linux): UID 和GID
    Name只是供看的
    Identifier才是系统层面的标识
    用户的行为是一系列进程的行为
    特性标识其实是进程的UID/GID

进程和文件的UID/GID (UserID/groupId)

文件资源的权限力度:UID/GID

1.文件是一类资源
2.在Linux中,甚至一切皆是文件,Socket,Driver
3.文件资源对不同Target(用户)的不同操作权限的需求应运而生
4.某些场景下,允许多个不同的Target/用户(而不是一个)具有一致的操作权限,怎么办? 
    Id===> Gid===> 多个用户可以属于一个GID,一个用户可以属于多个GIDs
5.所以文件权限的管理力度区分3类群体:属于特定UID的用户,属于特定GID的用户(们),其他用户
6.一个上帝用户存在:ROOT, 其UID = 0 , 上帝用户永远满足属于任何UID

文件的可操作权限

1.文件/文件夹的可读 r
2.文件/文件夹的可写 w
3.文件/文件夹的可执行 x

$ ls -l
total 20
 权限列表        UID       GID
-rw-r--r--    1 comtu    Administ      879 Feb 25 17:39 404.html
-rw-r--r--    1 comtu    Administ     2800 Feb 25 17:39 README.md
-rw-r--r--    1 comtu    Administ     2909 Feb 25 17:39 Rakefile.rb
-rw-r--r--    1 comtu    Administ     1609 Feb 25 17:39 _config.yml
drwxr-xr-x    4 comtu    Administ        0 Feb 25 17:39 _data
drwxr-xr-x    7 comtu    Administ     4096 Feb 25 17:39 _includes
drwxr-xr-x    5 comtu    Administ        0 Feb 25 17:39 _layouts
drwxr-xr-x    3 comtu    Administ        0 Feb 25 17:39 _plugins
drwxr-xr-x   18 comtu    Administ     8192 Jul  1 17:36 _posts
drwxr-xr-x   13 comtu    Administ     4096 Jul  1 13:30 _site
-rw-r--r--    1 comtu    Administ       10 Feb 25 17:39 baidu_verify_
html
-rw-r--r--    1 comtu    Administ     1672 Feb 25 17:39 index.html
drwxr-xr-x    1 comtu    Administ     4096 Feb 25 17:39 page
drwxr-xr-x    1 comtu    Administ     4096 Jun 25 16:18 res
-rw-r--r--    1 comtu    Administ       59 Jun 25 17:45 robots.txt
-rw-r--r--    1 comtu    Administ      350 Apr 13 17:53 search.xml
-rw-r--r--    1 comtu    Administ      209 Feb 25 17:39 sitemap.txt

drwxr-xr-x
d|rwx|r-x|r-x
0|123|456|789

文件夹与文件标识
    0 : d文件夹    -文件
UID用户
    1 : 可读
    2 : 可写
    3 : 可执行
GID用户
    4 : 可读
    5 : 不可写
    6 : 可执行
其他用户
    7 : 可读
    8 : 不可写
    9 : 可执行

进程的标识: PID , UID , GID , GIDs

PID : 进程的Unique Identifier(唯一标识) . 每次Running的PID可能相同,或者不同,由系统分配
UID : 进程的身份标识.每次运行,即便重启后默认都相同
GID : 进程的(组)身份标识.每次运行,即便重启后默认都相同.不同进程允许有相同的GID(组用户身份标识).
    同一进程允许属于多个GID.
GIDs: 进程所属的全部GID

Name和ID的映射

Android原代码之Name和ID映射表
/system/core/include/private/android_filesystem_config.h

/*
 * Copyright (C) 2007 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/* This file is used to define the properties of the filesystem
#  images generated by build tools (mkbootfs and mkyaffs2image) and
#  by the device side of adb.
*/

#ifndef _ANDROID_FILESYSTEM_CONFIG_H_
#define _ANDROID_FILESYSTEM_CONFIG_H_

#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>

/* This is the master Users and Groups config for the platform.
#  DO NOT EVER RENUMBER.
*/

#define AID_ROOT             0  /* traditional unix root user */

#define AID_SYSTEM        1000  /* system server */

#define AID_RADIO         1001  /* telephony subsystem, RIL */
#define AID_BLUETOOTH     1002  /* bluetooth subsystem */
#define AID_GRAPHICS      1003  /* graphics devices */
#define AID_INPUT         1004  /* input devices */
#define AID_AUDIO         1005  /* audio devices */
#define AID_CAMERA        1006  /* camera devices */
#define AID_LOG           1007  /* log devices */
#define AID_COMPASS       1008  /* compass device */
#define AID_MOUNT         1009  /* mountd socket */
#define AID_WIFI          1010  /* wifi subsystem */
#define AID_ADB           1011  /* android debug bridge (adbd) */
#define AID_INSTALL       1012  /* group for installing packages */
#define AID_MEDIA         1013  /* mediaserver process */
#define AID_DHCP          1014  /* dhcp client */
#define AID_SDCARD_RW     1015  /* external storage write access */
#define AID_VPN           1016  /* vpn system */
#define AID_KEYSTORE      1017  /* keystore subsystem */
#define AID_USB           1018  /* USB devices */
#define AID_GPS           1021  /* GPS daemon */
#define AID_UNUSED1       1022  /* deprecated, DO NOT USE */
#define AID_RFU1          1023  /* RFU */
#define AID_RFU2          1024  /* RFU */
#define AID_NFC           1025  /* nfc subsystem */

#define AID_SHELL         2000  /* adb and debug shell user */
#define AID_CACHE         2001  /* cache access */
#define AID_DIAG          2002  /* access to diagnostic resources */

/* The 3000 series are intended for use as supplemental group id's only.
 * They indicate special Android capabilities that the kernel is aware of. */
#define AID_NET_BT_ADMIN  3001  /* bluetooth: create any socket */
#define AID_NET_BT        3002  /* bluetooth: create sco, rfcomm or l2cap sockets */
#define AID_INET          3003  /* can create AF_INET and AF_INET6 sockets */
#define AID_NET_RAW       3004  /* can create raw INET sockets */
#define AID_NET_ADMIN     3005  /* can configure interfaces and routing tables. */
#define AID_QCOM_ONCRPC   3006  /* can read/write /dev/oncrpc files */

#if defined(MOTOROLA_UIDS)
#define AID_MOT_ACCY      9000  /* access to accessory */
#define AID_MOT_PWRIC     9001  /* power IC */
#define AID_MOT_USB       9002  /* mot usb */
#define AID_MOT_DRM       9003  /* can access DRM resource. */
#define AID_MOT_TCMD      9004  /* mot_tcmd */
#define AID_MOT_SEC_RTC   9005  /* mot cpcap rtc */
#define AID_MOT_TOMBSTONE 9006
#define AID_MOT_TPAPI     9007  /* mot_tpapi */
#define AID_MOT_SECCLKD   9008  /* mot_secclkd */
#endif // MOTOROLA_UIDS

#define AID_MISC          9998  /* access to misc storage */
#define AID_NOBODY        9999

#define AID_APP          10000 /* first app user */

#if !defined(EXCLUDE_FS_CONFIG_STRUCTURES)
struct android_id_info {
    const char *name;
    unsigned aid;
};

static const struct android_id_info android_ids[] = {
    { "root",      AID_ROOT, },
    { "system",    AID_SYSTEM, },
    { "radio",     AID_RADIO, },
    { "bluetooth", AID_BLUETOOTH, },
    { "graphics",  AID_GRAPHICS, },
    { "input",     AID_INPUT, },
    { "audio",     AID_AUDIO, },
    { "camera",    AID_CAMERA, },
    { "log",       AID_LOG, },
    { "compass",   AID_COMPASS, },
    { "mount",     AID_MOUNT, },
    { "wifi",      AID_WIFI, },
    { "dhcp",      AID_DHCP, },
    { "adb",       AID_ADB, },
    { "install",   AID_INSTALL, },
    { "media",     AID_MEDIA, },
    { "nfc",       AID_NFC, },
    { "shell",     AID_SHELL, },
    { "cache",     AID_CACHE, },
    { "diag",      AID_DIAG, },
    { "net_bt_admin", AID_NET_BT_ADMIN, },
    { "net_bt",    AID_NET_BT, },
    { "qcom_oncrpc", AID_QCOM_ONCRPC, },
    { "sdcard_rw", AID_SDCARD_RW, },
    { "vpn",       AID_VPN, },
    { "keystore",  AID_KEYSTORE, },
    { "usb",       AID_USB, },
    { "gps",       AID_GPS, },
    { "inet",      AID_INET, },
    { "net_raw",   AID_NET_RAW, },
    { "net_admin", AID_NET_ADMIN, },
#if defined(MOTOROLA_UIDS)
    { "mot_accy",  AID_MOT_ACCY, },
    { "mot_pwric", AID_MOT_PWRIC, },
    { "mot_usb",   AID_MOT_USB, },
    { "mot_drm",   AID_MOT_DRM, },
    { "mot_tcmd",  AID_MOT_TCMD, },
    { "mot_sec_rtc",  AID_MOT_SEC_RTC, },
    { "mot_tombstone", AID_MOT_TOMBSTONE, },
    { "mot_tpapi",  AID_MOT_TPAPI, },
    { "mot_secclkd",  AID_MOT_SECCLKD, },
#endif
    { "misc",      AID_MISC, },
    { "nobody",    AID_NOBODY, },
};

#define android_id_count \
    (sizeof(android_ids) / sizeof(android_ids[0]))
    
struct fs_path_config {
    unsigned mode;
    unsigned uid;
    unsigned gid;
    const char *prefix;
};

/* Rules for directories.
#  These rules are applied based on "first match", so they
#  should start with the most specific path and work their
#  way up to the root.
*/

static struct fs_path_config android_dirs[] = {
    { 00770, AID_SYSTEM, AID_CACHE,  "cache" },
    { 00771, AID_SYSTEM, AID_SYSTEM, "data/app" },
    { 00771, AID_SYSTEM, AID_SYSTEM, "data/app-private" },
    { 00771, AID_SYSTEM, AID_SYSTEM, "data/dalvik-cache" },
    { 00771, AID_SYSTEM, AID_SYSTEM, "data/data" },
    { 00771, AID_SHELL,  AID_SHELL,  "data/local/tmp" },
    { 00771, AID_SHELL,  AID_SHELL,  "data/local" },
    { 01771, AID_SYSTEM, AID_MISC,   "data/misc" },
    { 00770, AID_DHCP,   AID_DHCP,   "data/misc/dhcp" },
    { 00771, AID_SYSTEM, AID_SYSTEM, "data" },
    { 00750, AID_ROOT,   AID_SHELL,  "sbin" },
    { 00755, AID_ROOT,   AID_SHELL,  "system/bin" },
    { 00755, AID_ROOT,   AID_SHELL,  "system/vendor" },
    { 00755, AID_ROOT,   AID_SHELL,  "system/xbin" },
    { 00755, AID_ROOT,   AID_ROOT,   "system/etc/ppp" },
    { 00777, AID_ROOT,   AID_ROOT,   "sdcard" },
    { 00771, AID_SYSTEM, AID_SYSTEM, "sd-ext" },
    { 00755, AID_ROOT,   AID_ROOT,   0 },
};

/* Rules for files.
#  These rules are applied based on "first match", so they
#  should start with the most specific path and work their
#  way up to the root. Prefixes ending in * denotes wildcard
#  and will allow partial matches.
*/
static struct fs_path_config android_files[] = {
    { 00440, AID_ROOT,      AID_SHELL,     "system/etc/init.goldfish.rc" },
    { 00550, AID_ROOT,      AID_SHELL,     "system/etc/init.goldfish.sh" },
    { 00440, AID_ROOT,      AID_SHELL,     "system/etc/init.trout.rc" },
    { 00550, AID_ROOT,      AID_SHELL,     "system/etc/init.ril" },
    { 00550, AID_ROOT,      AID_SHELL,     "system/etc/init.testmenu" },
    { 00550, AID_DHCP,      AID_SHELL,     "system/etc/dhcpcd/dhcpcd-run-hooks" },
    { 00440, AID_BLUETOOTH, AID_BLUETOOTH, "system/etc/dbus.conf" },
    { 00440, AID_BLUETOOTH, AID_BLUETOOTH, "system/etc/bluetooth/main.conf" },
    { 00440, AID_BLUETOOTH, AID_BLUETOOTH, "system/etc/bluetooth/input.conf" },
    { 00440, AID_BLUETOOTH, AID_BLUETOOTH, "system/etc/bluetooth/audio.conf" },
    { 00444, AID_NET_BT,    AID_NET_BT,    "system/etc/bluetooth/blacklist.conf" },
    { 00640, AID_SYSTEM,    AID_SYSTEM,    "system/etc/bluetooth/auto_pairing.conf" },
    { 00444, AID_RADIO,     AID_AUDIO,     "system/etc/AudioPara4.csv" },
    { 00555, AID_ROOT,      AID_ROOT,      "system/etc/ppp/*" },
    { 00555, AID_ROOT,      AID_ROOT,      "system/etc/rc.*" },
    { 00644, AID_SYSTEM,    AID_SYSTEM,    "data/app/*" },
    { 00644, AID_SYSTEM,    AID_SYSTEM,    "data/app-private/*" },
    { 00644, AID_APP,       AID_APP,       "data/data/*" },
	/* the following three files are INTENTIONALLY set-gid and not set-uid.
	 * Do not change. */
    { 02755, AID_ROOT,      AID_NET_RAW,   "system/bin/ping" },
    { 02750, AID_ROOT,      AID_INET,      "system/bin/netcfg" },
    { 02755, AID_SYSTEM,    AID_GRAPHICS,  "system/bin/screenshot" },
	/* the following five files are INTENTIONALLY set-uid, but they
	 * are NOT included on user builds. */
    { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/su" },
    { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/librank" },
    { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/procrank" },
    { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/procmem" },
    { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/tcpdump" },
    { 04770, AID_ROOT,      AID_RADIO,     "system/bin/pppd-ril" },
		/* the following file is INTENTIONALLY set-uid, and IS included
		 * in user builds. */
    { 06750, AID_ROOT,      AID_SHELL,     "system/bin/run-as" },
    { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/hcitool" },
    { 00755, AID_ROOT,      AID_SHELL,     "system/bin/*" },
    { 00755, AID_ROOT,      AID_SHELL,     "system/xbin/*" },
    { 00755, AID_ROOT,      AID_SHELL,     "system/vendor/bin/*" },
    { 00750, AID_ROOT,      AID_SHELL,     "sbin/*" },
    { 00755, AID_ROOT,      AID_ROOT,      "bin/*" },
    { 00750, AID_ROOT,      AID_SHELL,     "init*" },
    { 00750, AID_ROOT,      AID_SHELL,     "system/etc/init.d/*" },
    { 00644, AID_ROOT,      AID_ROOT,       0 },
};

static inline void fs_config(const char *path, int dir,
			     unsigned *uid, unsigned *gid, unsigned *mode)
{
    struct fs_path_config *pc;
    int plen;
    
    pc = dir ? android_dirs : android_files;
    plen = strlen(path);
    for(; pc->prefix; pc++){
	int len = strlen(pc->prefix);
	if (dir) {
	    if(plen < len) continue;
	    if(!strncmp(pc->prefix, path, len)) break;
	    continue;
	}
	/* If name ends in * then allow partial matches. */
	if (pc->prefix[len -1] == '*') {
	    if(!strncmp(pc->prefix, path, len - 1)) break;
	} else if (plen == len){
	    if(!strncmp(pc->prefix, path, len)) break;
	}
    }
    *uid = pc->uid;
    *gid = pc->gid;
    *mode = (*mode & (~07777)) | pc->mode;
    
#if 0
    fprintf(stderr,"< '%s' '%s' %d %d %o >\n", 
	    path, pc->prefix ? pc->prefix : "", *uid, *gid, *mode);
#endif
}
#endif
#endif

Android提供了dumpsys工具来dump出所有的服务信息，通过以下命令可以查看系统注册的所有服务：adb shell dumpsys  
dumpsys 用来给出手机中所有应用程序的信息，并且也会给出现在手机的状态。
因为内容太多把dumpsys的内容存储到C盘文件中方便查看.如下

C:\Users\comtu>adb shell
shell@android:/ $ su
shell@android:/ # cd data
shell@android:/data # mkdir test
shell@android:/data # cd test
shell@android:/data/test # dumpsys > dumpsys.txt
shell@android:/data/test # ls -l
ls -l
-rw-rw-rw- root     root      1706976 2015-07-03 08:57 dumpsys.txt
shell@android:/data/test # exit
exit
shell@android:/ $ exit
exit
C:\Users\comtu>adb pull /data/test/dumpsys.txt c:/
5649 KB/s (1706976 bytes in 0.295s)

其中dumpsys.txt文件一段关于QQ配置的片段可查找到如下内容:
        userId=10081 gids=[3003, 1028, 1015] <---gids可在android_filesystem_config.h查找到对应的映射关系

Package [com.tencent.mobileqq] (426f1258):
  userId=10081 gids=[3003, 1028, 1015]
  pkg=Package{42b7e890 com.tencent.mobileqq}
  codePath=/data/app/partner-QQ.apk
  resourcePath=/data/app/partner-QQ.apk
  nativeLibraryPath=/data/app-lib/partner-QQ
  versionCode=122 targetSdk=7
  versionName=4.7.0
  applicationInfo=ApplicationInfo{42b136f8 com.tencent.mobileqq}
  flags=[ HAS_CODE ALLOW_CLEAR_USER_DATA ALLOW_BACKUP ]
  dataDir=/data/data/com.tencent.mobileqq
  supportsScreens=[small, medium, large, resizeable, anyDensity]
  usesOptionalLibraries:
    com.google.android.media.effects
    com.motorola.hardware.frontcamera
  timeStamp=2015-05-05 17:36:43
  firstInstallTime=2015-05-05 17:36:43
  lastUpdateTime=2015-05-05 17:36:43
  signatures=PackageSignatures{426f1320 [426f1ed0]}
  permissionsFixed=true haveGids=true installStatus=1
  pkgFlags=[ HAS_CODE ALLOW_CLEAR_USER_DATA ALLOW_BACKUP ]
  User 0:  installed=true blocked=false stopped=true notLaunched=false enabled=0
  grantedPermissions:
    android.permission.READ_EXTERNAL_STORAGE
    android.permission.CHANGE_WIFI_MULTICAST_STATE
    com.tencent.photos.permission.DATA
    android.permission.GET_TASKS
    android.permission.WRITE_EXTERNAL_STORAGE
    android.permission.WRITE_CALL_LOG
    com.tencent.msg.permission.pushnotify
    android.permission.ACCESS_WIFI_STATE
    android.permission.ACCESS_COARSE_LOCATION
    android.permission.READ_CONTACTS
    android.permission.CALL_PHONE
    android.permission.WRITE_CONTACTS
    com.tencent.permission.VIRUS_SCAN
    android.permission.READ_PHONE_STATE
    android.permission.READ_CALENDAR
    android.permission.READ_SMS
    android.permission.CAMERA
    android.permission.ACCESS_FINE_LOCATION
    android.permission.BROADCAST_STICKY
    android.permission.PERSISTENT_ACTIVITY
    android.permission.FLASHLIGHT
    android.permission.RECORD_AUDIO
    android.permission.WAKE_LOCK
    android.permission.ACCESS_NETWORK_STATE
    com.tencent.msf.permission.ACCOUNT_NOTICE
    com.android.launcher.permission.INSTALL_SHORTCUT
    com.tencent.msf.permission.account.sync
    android.permission.SEND_SMS
    com.android.launcher.permission.UNINSTALL_SHORTCUT
    android.permission.KILL_BACKGROUND_PROCESSES
    android.permission.MODIFY_AUDIO_SETTINGS
    android.permission.DISABLE_KEYGUARD
    android.permission.WRITE_CALENDAR
    com.qq.qcloud.permission.ACCESS_ALBUM_BACKUP_LIST
    android.permission.SYSTEM_ALERT_WINDOW
    android.permission.WRITE_SETTINGS
    android.permission.INTERNET
    android.permission.CHANGE_WIFI_STATE
    android.permission.VIBRATE
    android.permission.READ_CALL_LOG
    com.android.launcher.permission.READ_SETTINGS
    android.permission.CHANGE_NETWORK_STATE

Chmod和chown命令介绍

Chmod

1.文件R/W/X的系统内部采用3Bit表示,R为最高位比特,置位为0x04,
    W为中间比特,置位为0x02,X为最低比特,置位为0x01

    4(读R) , 2(写W) , 1(执行X)
    7=4+2+1 所有权限
    6=4+2   读写
    5=4+1   读执行
    4       读
    3=3+1   写执行
    2
    1
    664表示给予UID,GID读写权限,给予其它只读权限

2.Shell中表示时,置位使用相应R/W/X表示,未置位使用-
3.操作文件面向群体的操作权限时,使用Chmod,可以直接使用数字,
    也可使用助记符( a:all , u:owner user , g:group , +:add one premission , -:remove one permission)

-rw-rw-r-- system   system         12 2015-07-02 18:02 test.txt
shell@android:/data/test # chmod 777 test.txt
chmod 777 test.txt
shell@android:/data/test # ls -l
ls -l
-rwxrwxrwx system   system         12 2015-07-02 18:02 test.txt
shell@android:/data/test #
shell@android:/data/test # chmod 664 test.txt
chmod 664 test.txt
shell@android:/data/test # ls -l
ls -l
-rw-rw-r-- system   system         12 2015-07-02 18:02 test.txt
shell@android:/data/test #

Chown

通过chown改变文件的拥有者和群组。在更改文件的所有者UID或所属群组GID时，可以使用用户名称和用户识别码设置。
    Shell命令中通常采用Name方式修改,而不是ID方式.普通用户不能将自己的文件改变成其他的拥有者。其操作权限一般为管理员。
一般格式: chown newUID:newGID FileName

shell@android:/data # mkdir test
mkdir test
shell@android:/data # cd test
cd test
shell@android:/data/test # echo "hello world" > test.txt
echo "hello world" > test.txt
shell@android:/data/test # ls
ls
test.txt
shell@android:/data/test # ls -l
ls -l
-rw-rw-rw- root     root           12 2015-07-02 18:02 test.txt
shell@android:/data/test # chown system:system test.txt
chown system:system test.txt
shell@android:/data/test # ls -l
ls -l
-rw-rw-rw- system   system         12 2015-07-02 18:02 test.txt
shell@android:/data/test #

UID/GID的衔接

1.Linux一切皆是文件
2.文件基于UID/GID来划分它的面向群体,对它的面向群体定义不同的操作权限
3.用户的行为映射为进程的运行
4.进程的运行使用进程的UID/GID来标识自己的身份
5.进程的UID/GID<=====>文件的UID/GID 完美衔接~~
6.进程的UID/GID除了被授予可操作文件的范畴外,非文件范畴的需要进行权限控制的操作
    (如重启系统等特权操作)继续通过进程的UID/GID身份来进行控制和授权.
7.比如,对于Reboot这个API,其入口处可以check calling的Process的UID,如果不是Root,则Reject

进程的RealUID和EffectiveUID

linux下real uid被用于描述用户是谁，文件的拥有者，effective uid指程序执行时的用户组别，
用于判断程序是否有权去进行一些操作（例如读写文件），因此real uid是针对用户和文件(拥有者)而言，
而effective是针对运行的程序而言。一般来讲一个用户执行一个程序，
程序的effective uid会被设置为用户的real uid，这个effective uid与该程序的real uid(文件所有者)无关，只与执行者有关。

Real UID 是身份的标识 , 但没有"实权"

Effective UID 是权利的标识 
    文件,资源以及特权API操作时对进程是否有权限的识别的UID,即是指Effectivie UID

身份与权利的关系
    一般情况下,身份和权利是一至的,即Real UID = Effective UID.
    所以,默认ps cmd输出的UID指的是Effective UID , 而没有输出Real UID

Root用户的特权
    ROOT可以调用SetXUID对自己的身份进行升降.

UID的世袭
    子进程的Real UID = Effective UID = 父进程的Real UID (子嗣不能继承其特权Effective UID而仅能继承其Real UID)

文件的setUID标识

setUID可以让普通用户暂时获得文件权限的读写.

和基本的RWX设置类似,有助记符和直接数字设置.直接数字设置时,采用4位数字,第一位标志setUID
如下:

shell@android:/data/test $ ls -l
ls -l
-rw-rw-rw- shell    shell           7 2015-07-03 09:22 comtu.txt
-rw-rw-rw- root     root      1706976 2015-07-03 08:57 dumpsys.txt
-rw-rw-r-- system   system         12 2015-07-02 18:02 test.txt
shell@android:/data/test $ chmod 4775 comtu.txt
chmod 4775 comtu.txt
shell@android:/data/test $ ls -l
ls -l
-rwsrwxr-x shell    shell           7 2015-07-03 09:22 comtu.txt
-rw-rw-rw- root     root      1706976 2015-07-03 08:57 dumpsys.txt
-rw-rw-r-- system   system         12 2015-07-02 18:02 test.txt
shell@android:/data/test $ chmod 0775 comtu.txt
chmod 0775 comtu.txt
shell@android:/data/test $ ls -l
ls -l
-rwxrwxr-x shell    shell           7 2015-07-03 09:22 comtu.txt
-rw-rw-rw- root     root      1706976 2015-07-03 08:57 dumpsys.txt
-rw-rw-r-- system   system         12 2015-07-02 18:02 test.txt
shell@android:/data/test $ chmod u+s comtu.txt
chmod u+s comtu.txt
Bad mode
10|shell@android:/data/test $

说明
    chmod 4775 comtu.txt

    4775 第一位4表示开启setUID, 第二位7表示UID获取读写执行权限,
        第三位7表示Gid获取读写执行权限,最后5表示其它用户只有读与执行权限

    chmod 0775 comtu.txt
    0775 第一位0表示关闭setUID

    chmod u+s comtu.txt
    使用助记符,因为我使用的是Android的adb shell 是简化般linux对助记符不支持,如果使用ubuntu等则可进行操作.

Capability

Capability细粒度的权限控制

进程的Capability
    permitted Capability Sets 
        当前进程的权利的围栏,最大权利的范围,是Effective Capability Sets的超集
    Effectivte Capability Sets 
        当前进程的实际使用(支配)的权利集,该集内的Capability必须从属于Permitted Capability Sets . 
        该集合与Effective UID类似,是实际的权利标识.
    Inheritable Capability Sets
        子进程唯一可以直接继承的Capability Sets. 在Capability模式下,
        只有子进程的Inheritable Capability Sets = 父进程的Inheritable Capability Sets . 其他的皆是NO
文件的Capability
    Permitted Capability Sets
        该可执行文件可以为进程带来的Permitted Capability Sets
    Effective Capability Set
        仅1bit,Enable or disable , 标识该可执行文件running所在的进程的
        Permitted Capability Sets是否自动全部Assign到其Effective Capability Sets. 
        通常用于与传统的Root-setUID可执行文件向下兼容.
    Inheritable Capability Sets
        与进程的Inheritable Capability Sets 一起作用(位与)以决定新的进程的Permitted capability Sets

Capability BoundSet
    Capability BoundSet是进程的属性
    是进程自己为自己设定的安全围栏(Capability Sets) , 
        限制可执行文件的Permitted Capability Sets仅有局部能转化的Permitted Capability Sets
    Capability BoundSet能被子进程继承
    Init进程默认Capability BoundSet为全1

Spawn进程的Capability
    P'子进程  P父进程  F子进程运行起来的执行文件

    P'(permitted) = (P(inheritable)&F(inheritable))|(F(permitted)&cap_bset)
    P'(effective) = F(effective)?P'(permitted):0
    P'(inheritable) = P(inheritable)