Guardian Programmer's Guide

Creating and Managing Processes
Guardian Programmer’s Guide — 421922-014
16 - 10
Process Security
maximum stack size via an eld or PROCESS_LAUNCH_ parameter up to a limit of
32MB.
Also on both platforms, the heap can grow to the maximum size of the globals-heap
segment less the size of the global data. On the TNS/R platform, the maximum
globals-heap size is 1.1 GB. On the TNS/E platform, the maximum globals-heap size is
1536 MB.
If your native program needs additional space for user data, you can add extended
data segments to your process. Section 17, Managing Memory, provides details on
how to add segments and perform other memory-management activities.
Process Security
The system provides many tools for managing processes on the system, both at the
command-interpreter level and the procedure-call level. To prevent users from using
these tools to interfere with another user’s process (for example, to delete someone
else’s process) or access privileged data, the operating system provides tools for
protecting processes from each other and for protecting data from indiscriminate
access.
Each Guardian process is assigned a creator access ID (sometimes known as the
CAID), a process access ID (or PAID), and a stop mode. The following paragraphs
describe how the creator access ID, process access ID, and stop mode work together
to provide process security.
Creator Access ID and Process Access ID
The creator access ID (CAID) identifies the user who initiated the creation of the
process. The process access ID, which is often the same as the creator access ID,
determines whether the process has the authority to make file accesses (see
Section 2, Using the File System, for a discussion of file-access permissions). The
process access ID is also used to determine whether restricted actions against a
process (such as stopping the process or invoking the debugger) are possible.
Normally, the creator access ID and process access ID are set to the same value as
the process access ID of the creating process. For example, if the TACL process with
process access ID 4,56 starts a process $P1, then $P1 has creator access ID 4,56 and
process access ID 4,56. Similarly, if process $P1 starts process $P2, process $P2 will
have a process access ID of 4,56 and a creator access ID of 4,56. Any of these
processes can then access any files belonging to user 4,56 and stop or invoke the
debugger on any process started by this user.
The general rule for file access or performing any of the above actions on a process is
that your process must have a process access ID equal to one of the following:
•
The super ID (255, 255)
•
The process access ID of the group manager of the target file or process
•
The process access ID of the target process