Administering privilege

Privileges associated with a process

Each process has two sets of privileges:

The maximum set contains all the privileges granted to the process either as fixed or inherited privileges.
The working set contains all the privileges currently being used by the process.

A process has these sets initialized at the time it is created by a fork(2) system call. After a fork, the privileges of the parent and child processes are identical.

However, when an exec system call on an executable file is performed, the privilege sets are modified. The privilege policy determines how the new maximum and working sets are calculated.