<html><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title></title><style type="text/css">
<!--
.style1 {font-size: 18px;font-weight: bold;font-family: Georgia, "Times New Roman", Times, serif;}
.style2 {font-size: 14px}
a{color:#0000cc;text-decoration:none}
a:visited{color:#0000cc;text-decoration:none}
-->
</style></head>
<body style="margin:0px 0px 0px 0px;">
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td bgcolor="#cccccc"><span class="style1" style="margin-left:5px">sys_setuid <span class="style2">[kernel/sys.c] </span></span></td>
</tr>
<tr>
<td><p style="margin-left:22px;margin-top:0px"><br />
Sets the effective user ID of the current process. If the effective UID of the caller is root, the real UID and saved set-user-ID are also set. </p>
<p style="margin-left:10px"><strong>Arguments</strong></p>
<table width="100%" border="0" style="margin-left:20px; margin-right:20px">
<tr>
<td width="6%" valign="top"><em>eax</em></td>
<td width="94%">23</td>
</tr>
<tr>
<td valign="top"><em>ebx</em></td>
<td>New effective user ID. If it is different from the old effective UID, the process will be forbidden from leaving core dumps.</td>
</tr>
</table>
<p style="margin-left:10px" ><strong>Return values</strong></p>
<p style="margin-left:22px;margin-right:10px" >If the system call succeeds the return value is 0.<br />
If the system call fails the return value is one of the following <em>errno</em> values:</p>
<table width="100%" border="0" style="border:dashed;border-bottom-width:1px;border-left-width:1px;border-right-width:1px;border-top-width:1px;border-color:#333333;margin-left:22px;margin-right:22px">
<tr>
<td><table width="100%" border="0">
<tr>
<td width="10%" valign="top"><code>-EAGAIN</code></td>
<td width="90%"><code><em>ebx</em> does not match the current UID and <em>ebx</em> brings process over it's NPROC rlimit. </code></td>
</tr>
<tr>
<td valign="top"><code>-EPERM </code></td>
<td><code>The user is not privileged (does not have the CAP_SETUID capability) and <em>ebx</em> does not match the real UID or saved set-user-ID of the calling process. </code></td>
</tr>
</table></td>
</tr>
</table>
<p style="margin-left:10px"><strong>Remarks</strong></p>
<p style="margin-left:22px">Under Linux, sys_setuid is implemented like the POSIX version with the _POSIX_SAVED_IDS feature. This allows a set-user-ID (other than root) program to drop all of its user privileges, do some un-privileged work, and then re-engage the original effective user ID in a secure manner.<br />
<br />
If the user is root or the program is set-user-ID-root, special care must be taken. The sys_setuid function checks the effective user ID of the caller and if it is the superuser, all process related user ID's are set to <em>ebx</em>. After this has occurred, it is impossible for the program to regain root privileges.<br />
<br />
Thus, a set-user-ID-root program wishing to temporarily drop root privileges, assume the identity of a non-root user, and then regain root privileges afterwards cannot use sys_setuid.<br />
<br />
Linux has the concept of filesystem user ID, normally equal to the effective user ID. The sys_setuid call also sets the filesystem user ID of the current process. See <a href="138.html">sys_setfsuid</a>.</p>
<p style="margin-left:10px"><strong>Compatibility</strong></p>
<p style="margin-left:22px">n/a</p></td>
</tr>
</table></body></html>