In POSIX, every running process has three User IDs (UIDs) associated with it; the real UID, which identifies the user who launched the process, the effective UID, which is used to determine what resources the process can access, and the saved Set-User-ID (SUID), which is the effective UID the process had when it started (at the point of the last
exec() call). Of these, the effective UID is the most significant, since it is the one used when determining access control decisions regarding the process.
Daemons are typically started from init scripts, which are executed by the init system, running with root privileges. Processes may change the real/effective UID via the
setreuid() system calls. This is the case with the
dnscrypt-proxy invocation given as an example1 in the question. The
--user dnscrypt option tells
dnscrypt-proxy to assume the identity of the user
dnscrypt. A privileged process may assume the identity of any user (even changing its saved SUID), whereas unprivileged user processes may only set the effective UID to the real user ID, the effective UID or the saved set-user ID.
The basic uses cases for changing the UIDs is for a privileged process to drop its privileges, either permanently, or temporary. The latter case is needed by programs with the SUID bit set, which need to perform some unprivileged operations using their real UID, then regain their SUID granted privileges. The POSIX.1-1990 standard adopted the traditional System V behaviour for the
setuid() function, which specifies
setuid() to behave differently for privileged and unprivileged users. When the caller had the appropriate privilege, the function set the calling process' real UID, effective UID, and saved SUID. When the caller did not have the appropriate privilege, the function set only the effective UID, as described above.
In contrast, 4.3BSD did not support the saved SUID, but handles the latter case with separate functions. While
setuid() always set both the real and effective UIDs,
seteuid() could be used to set only the effective UID (like
setuid() in POSIX1-1990 for non-privileged users). Lastly,
setreuid() allowed processes to swap their real and effective UIDs, in order to support previously-privileged processes to regain their privileges.
The POSIX:2001 standard introduced a mandatory feature named _POSIX_SAVED_IDS. This allows a SUID application to switch its effective UID back and forth between the values of its saved SUID and effective user ID. More information can be found in the rationale section of the POSIX:2004 specification for
setuid(). In Linux,
setuid() is implemented like the POSIX version with the _POSIX_SAVED_IDS feature.
ps can be made to display the real UID, effective UID and saved SUID with the
suser format specifiers, e.g
ps -eo "ruser,euser,suser,args".