We understand from our previous discussions that every process alive has a set of four integer values that effectively determine its privileges, the real and effective user and group IDs; they are called the process credentials.

As mentioned earlier, we refer to them as the {RUID, EUID, RGID, EGID}.

The effective IDs are in bold font, to reiterate the fact that while the real IDs identify the original owner and group, when it comes to actually checking permissions, the kernel uses the effective IDs.

Where are the process credentials stored? The OS keeps this information as part of a rather large process attributes data structure (which is per-process of course); it is in kernel memory space.

The point is this: if the data is in kernel address space, the only way to get at it (query or set) is via system calls, of course.