Process manager abilities
Within the kernel and process manager, control over a process's ability to perform many actions is governed not by the user ID (UID) of the process, but by a set of approximately 70 permissions called process manager (procmgr) abilities.
Go to Abilities
for a list of abilities.
Root and non-root abilities
In traditional UNIX-like operating systems, a process that runs with a user ID of zero (UID 0; the root user or superuser) has extensive system-wide permissions that users that run as any other user ID don't.
- root set — checked whenever a process attempts an operation and its effective UID is 0. By default, this set contains all abilities.
- non-root set — checked whenever a process attempts an operation and its effective UID is non-zero. By default, it contains a
non-privileged
subset of abilities.
Both sets of abilities can be configured to allow a non-root process to become more privileged than normal and a root process to become less privileged.
Custom abilities
Because a process's abilities may also be tested by a server process that receives a message from it, abilities can control things outside the domain of the kernel and process manager. To make this capability more useful, the set of 70 or so static abilities may be augmented by additional custom abilities, allowing processes to use abilities to control access to whatever they see fit.
Configuring abilities
Use of abilities allows the privileges assigned to a process to be tailored to its needs rather
than being all or nothing. QNX recommends that you configure abilities using security
policies. For a full discussion of the advantages of this feature, go to the Security Policies
chapter.
The pre-security-policies way to configure abilities is to start up a process as root with the full set of abilities. After completing initialization, the process reconfigures its non-root set of abilities, granting privileged abilities it will require and dropping others. It then calls setuid() to switch permanently to non-root and continues with just what it needs for its operation. For more information, go to the procmgr_ability() entry in the C Library Reference.
The pidin utility allows you to display abilities information about a process. See the pidin entry in the Utilities Reference.