SETUID(2)

💖 SETUID(2) 💖

okay bestie, sit down, we're talking about setuid, seteuid, setgid and setegid — the System Calls Manual girlies that decide who your process actually is. user ID and group ID energy, no cap. 🫶

---

✨ NAME ✨

setuid, seteuid, setgid, setegid — set user and group ID. that's it, that's the whole vibe. 💅

---

📚 LIBRARY 📚

Standard C Library (libc, -lc). the classic. the blueprint. 🎀

---

🌸 SYNOPSIS 🌸

#include <unistd.h>

int
setuid(uid_t uid);

int
seteuid(uid_t euid);

int
setgid(gid_t gid);

int
setegid(gid_t egid);

---

💫 DESCRIPTION 💫

so, the setuid() system call? it sets the real and effective user IDs and the saved set-user-ID of the current process to the value you specify. it's giving "new identity, who dis". ✨

setuid() is permitted if the ID you specified equals the real user ID or the effective user ID of the process — or if the effective user ID is that of the super user. basically: you can be you, or you can be root and do whatever. 👑

the setgid() system call does the same little dance for groups: it sets the real and effective group IDs and the saved set-group-ID of the current process to the specified value. setgid() is permitted if the specified ID equals the real group ID or the effective group ID of the process, or if the effective user ID is that of the super user. slay. 💜

now the cute little sibling: the seteuid() system call (setegid()) sets the effective user ID (group ID) of the current process. the effective user ID may be set to the value of the real user ID or the saved set-user-ID (peep intro(2) and execve(2) if you wanna go deeper, bestie). this means the effective user ID of a set-user-ID executable may be toggled — switch to the real user ID, then re-enable by reverting to the set-user-ID value. it's giving light switch. 💡 similarly, the effective group ID may be set to the value of the real group ID or the saved set-group-ID.

---

🎀 RETURN VALUES 🎀

upon successful completion, the value 0 is returned. otherwise the value -1 is returned and the global variable errno is set to indicate the error. classic 0 or -1 moment, iykyk. 😭

---

💀 ERRORS 💀

these system calls will fail if:

• [EPERM] — the user is not the super user and the ID specified is not the real, effective ID, or saved ID. no permission, no party. 🚫

---

👀 SEE ALSO 👀

getgid(2), getuid(2), issetugid(2), setregid(2), setreuid(2)

the whole friend group fr fr. 🌈

---

📜 STANDARDS 📜

the setuid() and setgid() system calls are compliant with the ISO/IEC 9945-1:1990 (“POSIX.1”) specification with _POSIX_SAVED_IDS not defined, with the permitted extensions from Appendix B.4.2.2. the seteuid() and setegid() system calls are extensions based on the POSIX concept of _POSIX_SAVED_IDS, and have been proposed for a future revision of the standard. manifesting that glow-up for them. ⭐

---

🦋 HISTORY 🦋

the setuid() function appeared in Version 1 AT&T UNIX. the setgid() function appeared in Version 4 AT&T UNIX. old money, literally. 👑

---

🚨 SECURITY CONSIDERATIONS 🚨

okay this part is the serious part, bestie, so listen up. 👑

read and write permissions to files are determined upon a call to open(2). once a file descriptor is open, dropping privilege does not affect the process's read/write permissions — even if the user ID specified has no read or write permissions to the file. these files normally remain open in any new process executed, resulting in a user being able to read or modify potentially sensitive data. yes, that's as scary as it sounds. 😭

to prevent these files from remaining open after an exec(3) call, be sure to set the close-on-exec flag:

void
pseudocode(void)
{
        int fd;
        /* ... */

        fd = open("/path/to/sensitive/data", O_RDWR | O_CLOEXEC);
        if (fd == -1)
                err(1, "open");

        /* ... */
        execve(path, argv, environ);
}

bestie please set that O_CLOEXEC. the sensitive data does NOT need to stay open. it's giving leak. 💀

---

and that's the whole page, my love! this lil manual is from Debian, dated December 15, 2015, and it lives under the SETUID(2) name. take care of your privileges out there, they're main character energy. 💅✨🫶