I have a wrapper script
A which is calling program
A must be invoked as root so some initial setup can happen. After that,
A calls setuid() and setgid() to reduce its own privileges, for safety and security. Then,
The problem is that
B exhibits undesirable behavior if and only if
A has called setuid()/setgid() before invoking
B. This does not happen when I invoke
B directly as different users via
sudo -u xxx -g xxx. As far as I can tell (correct me if I am wrong), the only way
B could know that
A has changed the user is via the
issetuid() syscall (I've checked the environment variables; they match).
How can I clear this bit, so that
B behaves normally? It seems that the use of issetuid() is something about keeping track of whether the process is "tainted", i.e. carries artifacts from a less privileged environment (?). But I've reduced my privileges, not elevated them! And on top of that, I've scrubbed my env vars anyway!
Beyond the very terse man page on issetuid(), I can find almost nothing about this syscall/magical program state. Can anyone lend a better understanding?