Until now, we've talked about commands being executed by a particular user. That's not quite accurate because the computer never really knows which user is using it. If Eve learns Alice's username and password, then Eve can log in as Alice, and the computer will let Eve do everything that Alice can do. The system knows only which user ID is in use, not which user is typing the commands. If Alice can't be trusted to keep her password to herself, for example, then nothing you do as an application developer will prevent Eve from accessing Alice's files. The responsibility for system security is shared among the application developer, the users of the system, and the administrators of the system.
Every process has an associated user ID and group ID. When you invoke a command, it typically runs in a process whose user and group IDs are the same as your user and group IDs. When we say that a user performs an operation, we really mean that a process with the corresponding user ID performs that operation. When the process makes a system call, the kernel decides whether to allow the operation to proceed. It makes that determination by examining the permissions associated with the resources that the process is trying to access and by checking the user ID and group ID associated with the process trying to perform the action.
Now you know what that middle field printed by the id command is all about. It's showing the group ID of the current process. Even though user 501 is in multiple groups, the current process can have only one group ID. In the example shown previously, the current group ID is 501.
If you have to manipulate user IDs and group IDs in your program (and you will, if you're writing programs that deal with security), then you should use the uid_t and gid_t types defined in <sys/types.h>. Even though user IDs and group IDs are essentially just integers, avoid making any assumptions about how many bits are used in these types or perform arithmetic operations on them. Just treat them as opaque handles for user and group identity.
To get the user ID and group ID for the current process, you can use the geteuid and getegid functions, declared in <unistd.h>. These functions don't take any parameters, and they always work; you don't have to check for errors. Listing 10.1 shows a simple program that provides a subset of the functionality provide by the id command:
#include <sys/types.h> #include <unistd.h> #include <stdio.h> int main() { uid_t uid = geteuid (); gid_t gid = getegid (); printf ("uid=%d gid=%d\n", (int) uid, (int) gid); return 0; }
When this program is run (by the same user who ran the real id program) the output is as follows:
% ./simpleid
uid=501 gid=501