Before calling exec(), a privileged program must ensure that all user and group IDs are reset to the real (unprivileged) values. The new program should start completely unprivileged and have no ability to regain privilege.

How exec() Interacts with Saved Set-UID

There is one useful behavior: a successful exec() copies the effective user ID to the saved set-user-ID. This means even if you only called seteuid(getuid()) before exec (which normally doesn’t change the saved set-UID), the subsequent exec will copy the now-unprivileged EUID into the saved set-UID of the new program.

The exec copies EUID (now 1000) into saved set-UID, so the new program is fully unprivileged. However, this only works if the exec succeeds. If exec fails, the saved set-UID is unchanged — the process still has privilege=200. The program can then continue and do privileged work, which may be intentional (fallback behavior).

This is one of the most important rules in secure privileged programming: a privileged program must never exec a shell (bash, sh, zsh, etc.) while it still holds privilege.

Shells are general-purpose command interpreters with enormous power. Even if you don’t intend to provide interactive access, the shell can be manipulated through environment variables, startup scripts, argument parsing, and various other mechanisms to run arbitrary commands with your program’s effective UID.

Safe Alternative: Use execve() with Absolute Paths

If you must exec another program, use execve() directly with an absolute path. This bypasses PATH entirely:

/* DANGEROUS: relies on PATH — attacker could put a fake 'ls' in PATH */
execvp("ls", argv);

/* SAFE: absolute path, no PATH lookup, no shell involved */
execve("/bin/ls", argv, envp);

Set-UID Scripts Are Also Unsafe

On systems that honor set-UID bits on scripts, running them is just as dangerous as execing a shell directly. Linux wisely ignores the set-UID/set-GID bits on scripts (shell scripts, Python scripts, etc.) for this reason. Even on systems that do support them, their use should be avoided.

By default, open file descriptors survive across an exec(). If a privileged program opens a file that unprivileged users cannot read (say, /etc/shadow), the resulting file descriptor is a privileged resource. If the program then execs another program without closing that FD, the new program inherits it — and can read the sensitive file.

There are two ways to prevent this:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>

/*
 * safe_exec(): Safely execute another program from a privileged context.
 * 
 * Steps:
 *  1. Drop all privileges permanently
 *  2. Close sensitive file descriptors  
 *  3. Sanitize environment
 *  4. exec with absolute path
 */
void safe_exec(const char *prog_path, char *const argv[])
{
    uid_t uid = getuid();
    gid_t gid = getgid();

    /* Step 1: Permanently drop ALL privileges */
    /* Drop supplementary groups first (still need EUID=0 for this) */
    if (setgroups(0, NULL) == -1) {
        perror("setgroups");
        exit(EXIT_FAILURE);
    }

    /* Drop group ID */
    if (setresgid(gid, gid, gid) == -1) {
        perror("setresgid");
        exit(EXIT_FAILURE);
    }

    /* Drop user ID last */
    if (setresuid(uid, uid, uid) == -1) {
        perror("setresuid");
        exit(EXIT_FAILURE);
    }

    /* Verify the drop succeeded */
    if (geteuid() != uid || getuid() != uid) {
        fprintf(stderr, "FATAL: privilege drop failed before exec\n");
        exit(EXIT_FAILURE);
    }

    /* Step 2: Close any sensitive FDs above stdin/stdout/stderr */
    /* Simple approach: close all FDs from 3 upward */
    int max_fd = (int)sysconf(_SC_OPEN_MAX);
    for (int fd = 3; fd < max_fd; fd++) {
        close(fd);  /* Ignore errors — FD may not be open */
    }

    /* Step 3: Sanitize critical environment variables */
    /* Set PATH to known-safe value */
    if (setenv("PATH", "/usr/local/bin:/usr/bin:/bin", 1) == -1) {
        perror("setenv PATH");
        exit(EXIT_FAILURE);
    }
    /* Clear IFS — prevents shell word-splitting exploits */
    if (setenv("IFS", "", 1) == -1) {
        perror("setenv IFS");
        exit(EXIT_FAILURE);
    }

    /* Step 4: exec with absolute path (never use execlp/execvp in privileged code) */
    execv(prog_path, argv);

    /* If we get here, exec failed */
    perror("execv");
    exit(EXIT_FAILURE);
}

int main(int argc, char *argv[])
{
    printf("Running as EUID: %d\n", (int)geteuid());

    /* Build the argument list */
    char *args[] = { "/bin/ls", "-la", "/tmp", NULL };

    /* This will drop privilege before executing ls */
    safe_exec("/bin/ls", args);

    /* Never reached */
    return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>

/*
 * Demonstrates two ways to prevent FD inheritance across exec():
 *  1. Open with O_CLOEXEC flag (atomic — preferred)
 *  2. Set FD_CLOEXEC on existing FD using fcntl()
 */

int open_private_file(const char *path)
{
    int fd;

    /* Method 1: Open with O_CLOEXEC — atomic, preferred */
    fd = open(path, O_RDONLY | O_CLOEXEC);
    if (fd == -1) {
        perror("open");
        return -1;
    }

    printf("Opened fd=%d for '%s' with O_CLOEXEC\n", fd, path);
    return fd;
}

void set_cloexec_on_existing(int fd)
{
    int flags;

    /* Method 2: Set FD_CLOEXEC on an already-open FD */
    flags = fcntl(fd, F_GETFD);
    if (flags == -1) {
        perror("fcntl F_GETFD");
        return;
    }

    flags |= FD_CLOEXEC;
    if (fcntl(fd, F_SETFD, flags) == -1) {
        perror("fcntl F_SETFD");
        return;
    }

    printf("Set FD_CLOEXEC on fd=%d\n", fd);
}

int main(void)
{
    /* Open a file that should not be inherited by child processes */
    int sensitive_fd = open_private_file("/etc/hostname");
    if (sensitive_fd == -1)
        return 1;

    /* Or set it after opening */
    int another_fd = open("/etc/os-release", O_RDONLY);
    if (another_fd != -1) {
        set_cloexec_on_existing(another_fd);
    }

    printf("\nBoth FDs will be automatically closed on exec()\n");
    printf("No privileged file access leaks to child programs.\n");

    /* These FDs would be closed if we called exec() here */
    close(sensitive_fd);
    if (another_fd != -1) close(another_fd);

    return 0;
}