Why I can not drop sudo root privileges?

Question

I am debugging a program and not quite sure why I can not drop privileges.

I have root permissions via sudo and I can call setgid/setuid, but the operation [is] is not supported.

Basic code to reproduce (golang):

package main

import (
    "fmt"
    "os"
    "strconv"
    "syscall"
)

func main() {
    if os.Getuid() != 0 {
        fmt.Println("run as root")
        os.Exit(1)
    }

    uid, err := strconv.Atoi(os.Getenv("SUDO_UID"))
    check("", err)

    gid, err := strconv.Atoi(os.Getenv("SUDO_GID"))
    check("", err)

    fmt.Printf("uid: %d, gid: %d\n", uid, gid)

    check("gid", syscall.Setgid(gid))
    check("uid", syscall.Setuid(uid))
}

func check(message string, err error) {
    if err != nil {
        fmt.Printf("%s: %s\n", message, err)
        os.Exit(1)
    }
}

Example output:

$ sudo ./drop-sudo 
uid: 1000, gid: 1000
gid: operation not supported

System info:

$ uname -a
Linux user2460234 4.15.0-34-generic #37-Ubuntu SMP Mon Aug 27 15:21:48 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Answer 1

Your programming language simply does not support such things.

It's complex to do this stuff on Linux, because of the architecture of Linux. The C libraries (e.g. GNU and musl) hide this complexity. It continues to be one of the known problems with threads on Linux.

The Go language does not replicate the mechanism of the C libraries. The current implementation of those functions is not a system call, and has not been since 2014.

Further reading

• Jonathan de Boyne Pollard (2010). The known problems with threads on Linux. Frequently Given Answers.
• Michał Derkacz (2011-01-21). syscall: Setuid/Setgid doesn't apply to all threads on Linux. Go bug #1435

Answer 2

You can check with libcap, it has an official go library with examples. The example uses psx.Syscall3(syscall.SYS_SETUID,...) to set uid (as @JdeBP said, go removes implementation for syscall.Setuid()). The psx library is part of libcap.

Package psx provides a CGo backed API for invoking system calls in a way that each system call is mirrored on all pthreads of the combined Go/CGo runtime. Since the Go runtime treats all pthreads as interchangeable, a feature like this is needed to meaningfully change process privilege (including dropping privilege) in a Go program running on Linux

Answer 3

As of go 1.16, syscall.Setuid() and friends are fully supported under Linux.

That is, the reproducer program provided in this question, compiled using the go1.16 toolchain under Linux, will build a program that works as intended. All of the observations that it doesn't work are only true of earlier go toolchain releases under Linux.

The psx package can be used to make something like it work in earlier go toolchains too (as noted by ivzhh).