Section 4.7. access Function

4.7. access Function

As we described earlier, when we open a file, the kernel performs its access tests based on the effective user and group IDs. There are times when a process wants to test accessibility based on the real user and group IDs. This is useful when a process is running as someone else, using either the set-user-ID or the set-group-ID feature. Even though a process might be set-user-ID to root, it could still want to verify that the real user can access a given file. The access function bases its tests on the real user and group IDs. (Replace effective with real in the four steps at the end of Section 4.5.)

 #include <unistd.h> int access(const char *pathname, int mode); 

Returns: 0 if OK, 1 on error

The mode is the bitwise OR of any of the constants shown in Figure 4.7.

Figure 4.7. The mode constants for access function, from <unistd.h>

mode	Description
R_OK	test for read permission
W_OK	test for write permission
X_OK	test for execute permission
F_OK	test for existence of file

Example

Figure 4.8 shows the use of the access function.

Here is a sample session with this program:

          $ ls -l a.out          -rwxrwxr-x 1 sar         15945 Nov 30 12:10 a.out          $ ./a.out a.out          read access OK          open for reading OK          $ ls -l /etc/shadow          -r-------- 1 root         1315 Jul 17 2002 /etc/shadow          $ ./a.out /etc/shadow          access error for /etc/shadow: Permission denied          open error for /etc/shadow: Permission denied          $ su                        become superuser          Password:                  enter superuser password          # chown root a.out         change file's user ID to root          # chmod u+s a.out          and turn on set-user-ID bit          # ls -l a.out              check owner and SUID bit          -rwsrwxr-x 1 root     15945 Nov 30 12:10 a.out          # exit                     go back to normal user          $ ./a.out /etc/shadow          access error for /etc/shadow: Permission denied          open for reading OK 

In this example, the set-user-ID program can determine that the real user cannot normally read the file, even though the open function will succeed.

Figure 4.8. Example of access function

#include "apue.h" #include <fcntl.h> int main(int argc, char *argv[]) {     if (argc != 2)         err_quit("usage: a.out <pathname>");     if (access(argv[1], R_OK) < 0)         err_ret("access error for %s", argv[1]);     else         printf("read access OK\n");     if (open(argv[1], O_RDONLY) < 0)         err_ret("open error for %s", argv[1]);     else         printf("open for reading OK\n");     exit(0); } 

In the preceding example and in Chapter 8, we'll sometimes switch to become the superuser, to demonstrate how something works. If you're on a multiuser system and do not have superuser permission, you won't be able to duplicate these examples completely.