setreuid(2)

💖 setreuid(2) — the System Calls Manual, but make it make sense 💖

okay bestie, sit down, grab your boba, because today we're talking about setreuid(2) — that's the page from section 2 of the manual (system calls, the kernel-flavored ones 🧚). It's also lowkey about her sister setregid(2) because they're literally twins, same page, same vibe.

---

✨ NAME ✨

setreuid, setregid — set real and/or effective user or group ID. that's it, that's the whole job 💅

---

📚 LIBRARY 📚

Standard C library — that's libc, which you link with -lc. girl the standard library ate and left no crumbs 🫶

---

🎀 SYNOPSIS 🎀

#include <unistd.h>

int setreuid(uid_t ruid, uid_t euid);
int setregid(gid_t rgid, gid_t egid);

🌸 Feature Test Macro Requirements for glibc (see feature_test_macros(7)) 🌸

so before you can even use these, glibc is gonna vibe check you:

setreuid(), setregid():
    _XOPEN_SOURCE >= 500
        || /* Since glibc 2.19: */ _DEFAULT_SOURCE
        || /* glibc <= 2.19: */ _BSD_SOURCE

no cap, you literally have to define one of those or it's giving "not available" 🙈

---

💅 DESCRIPTION 💅

setreuid() sets the real and effective user IDs of the calling process. main character energy, but for your process identity ✨

Hand it a value of -1 for either the real or effective user ID and the system is like "ok bestie, not touching that one" — that ID stays unchanged.

Unprivileged processes may only set the effective user ID to one of these three:

• the real user ID
• the effective user ID
• the saved set-user-ID

Unprivileged users may only set the real user ID to one of these two:

• the real user ID
• the effective user ID

And here's the plot twist 👀 — if the real user ID is set (like, ruid is not -1) or the effective user ID gets set to something that isn't equal to the previous real user ID, then the saved set-user-ID gets set to the new effective user ID. sneak attack, honestly.

Completely analogously (in the same way, for the group chat that missed it), setregid() sets the real and effective group ID's of the calling process — and every single thing above holds, just with "group" swapped in wherever it said "user". same energy, different ID type 💖

---

⭐ RETURN VALUE ⭐

• Success? You get 0. slay. 🎉
• Error? You get -1, and errno gets set to tell you what went wrong.

Note: there are cases where setreuid() can fail even when the caller is UID 0. It is a grave security error to omit checking for a failure return from setreuid(). like, actually catastrophic. don't be that girl. check your return values, periodt. 💀

---

💜 ERRORS 💜

• EAGAIN — the call would change the caller's real UID (i.e., ruid does not match the caller's real UID), but there was a temporary failure allocating the necessary kernel data structures. temporary!! like a situationship.
• EAGAIN — ruid does not match the caller's real UID and this call would bring the number of processes belonging to the real user ID ruid over the caller's RLIMIT_NPROC resource limit. Since Linux 3.1, this error case no longer occurs (but robust applications should check for this error anyway — be an over-preparer, it's a look); see the description of EAGAIN in execve(2).
• EINVAL — one or more of the target user or group IDs is not valid in this user namespace. rude, but okay.
• EPERM — the calling process is not privileged (on Linux, that means it doesn't have the necessary capability in its user namespace: CAP_SETUID in the case of setreuid(), or CAP_SETGID in the case of setregid()) and a change other than these three was specified:
  1. swapping the effective user (group) ID with the real user (group) ID
  2. setting one to the value of the other
  3. setting the effective user (group) ID to the value of the saved set-user-ID (saved set-group-ID)

i.e., you tried to do a thing you are simply not invited to do 🙅♀️

---

🦋 VERSIONS 🦋

POSIX.1 does not specify all of the UID changes that Linux permits for an unprivileged process. so there's ✨range✨.

For setreuid(), the effective user ID can be made the same as the real user ID or the saved set-user-ID, and it is unspecified whether unprivileged processes may set the real user ID to the real user ID, the effective user ID, or the saved set-user-ID.

For setregid(), the real group ID can be changed to the value of the saved set-group-ID, and the effective group ID can be changed to the value of the real group ID or the saved set-group-ID.

The precise details of what ID changes are permitted vary across implementations. so don't assume, bestie, check.

POSIX.1 makes no specification about the effect of these calls on the saved set-user-ID and saved set-group-ID. it's giving "unspecified".

---

👑 STANDARDS 👑

POSIX.1-2024. certified iconic. 🌈

---

💀 HISTORY 💀

• POSIX.1-2001, 4.3BSD (first appeared in 4.2BSD). old money, literally.
• Setting the effective user (group) ID to the saved set-user-ID (saved set-group-ID) is possible since Linux 1.1.37 (1.1.38). 🧚
• The original Linux setreuid() and setregid() system calls supported only 16-bit user and group IDs. Subsequently, Linux 2.4 added setreuid32() and setregid32(), supporting 32-bit IDs. The glibc setreuid() and setregid() wrapper functions transparently deal with the variations across kernel versions — so you don't have to think about it, they handle it for you like the good friend they are 🫶

🧚 C library/kernel differences 🧚

At the kernel level, user IDs and group IDs are a per-thread attribute. but POSIX requires that all threads in a process share the same credentials. conflict!! 😭

The NPTL threading implementation handles the POSIX requirements by providing wrapper functions for the various system calls that change process UIDs and GIDs. These wrapper functions (including those for setreuid() and setregid()) employ a signal-based technique to ensure that when one thread changes credentials, all of the other threads in the process also change their credentials. like a group chat where everyone updates at once, no one left on read ✨

For details, see nptl(7).

---

🌈 SEE ALSO 🌈

getgid(2), getuid(2), seteuid(2), setgid(2), setresuid(2), setuid(2), capabilities(7), credentials(7), user_namespaces(7)

go read those next, bestie, they're all in the same friend group 💅

---

okay that's the whole page!! this was Linux man-pages 6.20, dated 2026-02-08, and it was setreuid(2) all along 🎀 mwah, go check your return values, ily, bye 💖✨🦋