Not able to assign root privilege to my process again by using setuid(0) in the same boot cycle

Question

I have added the capability by using following cmd on terminal (alternative of setting CAP_SETUID in drop-in file). Verified that setuid/seteuid is working.

setcap  cap_sys_admin,cap_setuid+ep   /usr/bin/<processname>

Now I want to to set my process privileged as root --> sync() --> set to original privilege---> do some work --> set as root again--->sync()

while using setuid(),I have found out that we can set process as root only one time in one boot cycle. However it can be done by seteuid(), I have tried that also , still not able to achieved the desired result.

Can you please suggest what I am missing or doing work.

int id = geteuid();
int r0= seteuid(0); // This will raise process to root mode     
sync();  //process can perform operation as root  user
seteuid(id);  //set process as non root  user

first time r0 is 0[successful], second time r0 is -1[error in seteuid(0)] . (In same boot cycle) Thanks in advance.

Answer 1

Unfortunately I could not find an explicit explanation in the kernel documentation, just a hint in man 2 setuid:

If the user is root or the program is set-user-ID-root, special care must be taken: setuid() checks the effective user ID of the caller and if it is the superuser, all process-related user ID's are set to uid. After this has occurred, it is impossible for the program to regain root privileges.

It would not make much sense to allow this to render this assertion invalid by adding capabilities. Why would a FSCAP program be more powerful than a SUID root program?

If this answer on SO is correct, then your problem can be explained as:

By default, capability sets are lost across an UID transition

The different behaviours of setuid() and seteuid() are intentional and cover different scenarios (switching back to root shall (not) be allowed).