262 lines
6.5 KiB
HTML
262 lines
6.5 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of SETRESUID</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>SETRESUID</H1>
|
|
Section: Linux Programmer's Manual (2)<BR>Updated: 2017-09-15<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
setresuid, setresgid - set real, effective and saved user or group ID
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>#define _GNU_SOURCE</B> /* See <A HREF="/cgi-bin/man/man2html?7+feature_test_macros">feature_test_macros</A>(7) */
|
|
|
|
<BR>
|
|
|
|
<B>#include <<A HREF="file:///usr/include/unistd.h">unistd.h</A>></B>
|
|
|
|
<P>
|
|
|
|
<B>int setresuid(uid_t </B><I>ruid</I><B>, uid_t </B><I>euid</I><B>, uid_t </B><I>suid</I><B>);</B>
|
|
|
|
<BR>
|
|
|
|
<B>int setresgid(gid_t </B><I>rgid</I><B>, gid_t </B><I>egid</I><B>, gid_t </B><I>sgid</I><B>);</B>
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>setresuid</B>()
|
|
|
|
sets the real user ID, the effective user ID, and the
|
|
saved set-user-ID of the calling process.
|
|
<P>
|
|
|
|
An unprivileged process may change its real UID,
|
|
effective UID, and saved set-user-ID, each to one of:
|
|
the current real UID, the current effective UID or the
|
|
current saved set-user-ID.
|
|
<P>
|
|
|
|
A privileged process (on Linux, one having the <B>CAP_SETUID</B> capability)
|
|
may set its real UID, effective UID, and
|
|
saved set-user-ID to arbitrary values.
|
|
<P>
|
|
|
|
If one of the arguments equals -1, the corresponding value is not changed.
|
|
<P>
|
|
|
|
Regardless of what changes are made to the real UID, effective UID,
|
|
and saved set-user-ID, the filesystem UID is always set to the same
|
|
value as the (possibly new) effective UID.
|
|
<P>
|
|
|
|
Completely analogously,
|
|
<B>setresgid</B>()
|
|
|
|
sets the real GID, effective GID, and saved set-group-ID
|
|
of the calling process (and always modifies the filesystem GID
|
|
to be the same as the effective GID),
|
|
with the same restrictions for unprivileged processes.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>RETURN VALUE</H2>
|
|
|
|
On success, zero is returned.
|
|
On error, -1 is returned, and
|
|
<I>errno</I>
|
|
|
|
is set appropriately.
|
|
<P>
|
|
|
|
<I>Note</I>:
|
|
|
|
there are cases where
|
|
<B>setresuid</B>()
|
|
|
|
can fail even when the caller is UID 0;
|
|
it is a grave security error to omit checking for a failure return from
|
|
<B>setresuid</B>().
|
|
|
|
<A NAME="lbAF"> </A>
|
|
<H2>ERRORS</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>EAGAIN</B>
|
|
|
|
<DD>
|
|
The call would change the caller's real UID (i.e.,
|
|
<I>ruid</I>
|
|
|
|
does not match the caller's real UID),
|
|
but there was a temporary failure allocating the
|
|
necessary kernel data structures.
|
|
<DT id="2"><B>EAGAIN</B>
|
|
|
|
<DD>
|
|
<I>ruid</I>
|
|
|
|
does not match the caller's real UID and this call would
|
|
bring the number of processes belonging to the real user ID
|
|
<I>ruid</I>
|
|
|
|
over the caller's
|
|
<B>RLIMIT_NPROC</B>
|
|
|
|
resource limit.
|
|
Since Linux 3.1, this error case no longer occurs
|
|
(but robust applications should check for this error);
|
|
see the description of
|
|
<B>EAGAIN</B>
|
|
|
|
in
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="3"><B>EINVAL</B>
|
|
|
|
<DD>
|
|
One or more of the target user or group IDs
|
|
is not valid in this user namespace.
|
|
<DT id="4"><B>EPERM</B>
|
|
|
|
<DD>
|
|
The calling process is not privileged (did not have the necessary
|
|
capability in its user namespace)
|
|
and tried to change the IDs to values that are not permitted.
|
|
For
|
|
<B>setresuid</B>(),
|
|
|
|
the necessary capability is
|
|
<B>CAP_SETUID</B>;
|
|
|
|
for
|
|
<B>setresgid</B>(),
|
|
|
|
it is
|
|
<B>CAP_SETGID</B>.
|
|
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>VERSIONS</H2>
|
|
|
|
These calls are available under Linux since Linux 2.1.44.
|
|
<A NAME="lbAH"> </A>
|
|
<H2>CONFORMING TO</H2>
|
|
|
|
These calls are nonstandard;
|
|
they also appear on HP-UX and some of the BSDs.
|
|
<A NAME="lbAI"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
Under HP-UX and FreeBSD, the prototype is found in
|
|
<I><<A HREF="file:///usr/include/unistd.h">unistd.h</A>></I>.
|
|
|
|
Under Linux, the prototype is provided by glibc since version 2.3.2.
|
|
<P>
|
|
|
|
The original Linux
|
|
<B>setresuid</B>()
|
|
|
|
and
|
|
<B>setresgid</B>()
|
|
|
|
system calls supported only 16-bit user and group IDs.
|
|
Subsequently, Linux 2.4 added
|
|
<B>setresuid32</B>()
|
|
|
|
and
|
|
<B>setresgid32</B>(),
|
|
|
|
supporting 32-bit IDs.
|
|
The glibc
|
|
<B>setresuid</B>()
|
|
|
|
and
|
|
<B>setresgid</B>()
|
|
|
|
wrapper functions transparently deal with the variations across kernel versions.
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H3>C library/kernel differences</H3>
|
|
|
|
At the kernel level, user IDs and group IDs are a per-thread attribute.
|
|
However, POSIX requires that all threads in a process
|
|
share the same credentials.
|
|
The NPTL threading implementation handles the POSIX requirements by
|
|
providing wrapper functions for
|
|
the various system calls that change process UIDs and GIDs.
|
|
These wrapper functions (including those for
|
|
<B>setresuid</B>()
|
|
|
|
and
|
|
<B>setresgid</B>())
|
|
|
|
employ a signal-based technique to ensure
|
|
that when one thread changes credentials,
|
|
all of the other threads in the process also change their credentials.
|
|
For details, see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+nptl">nptl</A></B>(7).
|
|
|
|
<A NAME="lbAK"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+getresuid">getresuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+getuid">getuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setfsgid">setfsgid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setfsuid">setfsuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setreuid">setreuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setuid">setuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+credentials">credentials</A></B>(7),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+user_namespaces">user_namespaces</A></B>(7)
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H2>COLOPHON</H2>
|
|
|
|
This page is part of release 5.05 of the Linux
|
|
<I>man-pages</I>
|
|
|
|
project.
|
|
A description of the project,
|
|
information about reporting bugs,
|
|
and the latest version of this page,
|
|
can be found at
|
|
<A HREF="https://www.kernel.org/doc/man-pages/.">https://www.kernel.org/doc/man-pages/.</A>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="5"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="6"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="7"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="8"><A HREF="#lbAE">RETURN VALUE</A><DD>
|
|
<DT id="9"><A HREF="#lbAF">ERRORS</A><DD>
|
|
<DT id="10"><A HREF="#lbAG">VERSIONS</A><DD>
|
|
<DT id="11"><A HREF="#lbAH">CONFORMING TO</A><DD>
|
|
<DT id="12"><A HREF="#lbAI">NOTES</A><DD>
|
|
<DL>
|
|
<DT id="13"><A HREF="#lbAJ">C library/kernel differences</A><DD>
|
|
</DL>
|
|
<DT id="14"><A HREF="#lbAK">SEE ALSO</A><DD>
|
|
<DT id="15"><A HREF="#lbAL">COLOPHON</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:34 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|