permission and user/group of a program executed through a script

Question

I am curious, in the following scenario, what kind of permission does a shell script or Java program has (owner/group/other)?

There is a script called run.sh, and it in turn calls a Java program a.java. The script and the java is owned by user A and have -rwxrw-r-- permissions. When they were run by user A, which permission group do they belong to? Do they get the permission from user A as a owner?

And there is another user B, who is in the same group with user A. He execute run.sh and in turn calls the Java program. Now what permission group do they belong to? Do they get the permission from user B as a group?

Maybe the program will try to write on a directory /common/abc which have a permission of drwxrw-r--, if the program have a permission of "other", it will fail.

A point to notice, is that they both use the expression sh run.sh to run the script, so they don't need the execute permission. Does it only require the read permission?

Answer 1

All processes start executing as the same user and group(s) as the process that call them, unless they are called through a setuid or setgid executable, i.e. one that has rws or r-s or -ws or --s in its permissions. The permission bits other than the s bit are irrelevant. The owner of the executable only matter if the script is setuid (i.e. has the s bit set in the user column), and the owning group only matters if the script is setgid (i.e. has the s bit set in the group column.

Therefore, in the scenario you describe, when user A runs the script, the script and the Java program are both executed as user A, and as whatever group(s) A belongs to. When they are executed by user B, they are executed as user B and as whatever group(s) user B belongs to.

Running a native executable requires execution permission and nothing more. Running a script (a program starting with #!) requires both execution permission (to start the execution, before the #! mechanism takes over) and read permission (for the interpreter to read the script). If you invoke the interpreter explicitly, the script doesn't need to be executable: as far as the system is concerned, it's just another data file.