The kernel enforces the following rules whenever a process changes its user IDs. These rules are applied automatically by the kernel — the process does not need to take any action.

This program demonstrates all three main UID-to-capability transition rules. It must be run as root (or as a set-user-ID-root binary) to show the transitions. It prints the capability state before and after each UID change to make the kernel’s automatic adjustments visible.

/*
 * uid_cap_transitions.c
 *
 * Demonstrates how the kernel automatically adjusts capability sets
 * when a process changes its user IDs. Shows all three main rules:
 *
 *   Rule 2: EUID 0 -> nonzero: effective caps cleared
 *   Rule 3: EUID nonzero -> 0: permitted copied to effective
 *   Rule 1: All UIDs -> nonzero: both permitted and effective cleared
 *
 * MUST run as root (or as set-user-ID-root):
 *   sudo ./uid_cap_transitions
 *   OR:
 *   sudo chown root ./uid_cap_transitions
 *   sudo chmod u+s ./uid_cap_transitions
 *   ./uid_cap_transitions
 *
 * Compile:
 *   gcc -o uid_cap_transitions uid_cap_transitions.c -lcap
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/capability.h>
#include <unistd.h>

/*
 * print_cap_summary() - Print a one-line summary of the process's capability state.
 * We show the compact text representation plus the current UIDs.
 */
static void print_cap_summary(const char *label)
{
    cap_t caps;
    char *text;

    caps = cap_get_proc();
    if (caps == NULL) { perror("cap_get_proc"); return; }

    text = cap_to_text(caps, NULL);

    printf("  [%-40s]  RUID=%-4d EUID=%-4d  caps=[%s]\n",
           label,
           (int)getuid(), (int)geteuid(),
           (text && text[0]) ? text : "none");

    if (text) cap_free(text);
    cap_free(caps);
}

int main(void)
{
    printf("=== UID to Capability Transition Demo ===\n\n");

    if (geteuid() != 0) {
        fprintf(stderr,
            "This program must run with effective UID 0 (root).\n"
            "Try: sudo ./uid_cap_transitions\n");
        return 1;
    }

    /* ================================================================
     * Initial state: running as root
     * Expected: caps = "=ep" (all capabilities in effective + permitted)
     * ================================================================ */
    printf("--- Initial state (root) ---\n");
    print_cap_summary("Initial: EUID=0");

    /* ================================================================
     * RULE 2 DEMONSTRATION
     * Change effective UID from 0 to non-zero.
     * Expected effect: effective capability set is CLEARED.
     * Permitted set is preserved.
     * ================================================================ */
    printf("\n--- Demonstrating Rule 2: EUID 0 -> nonzero ---\n");
    printf("    (Effective caps should be CLEARED; permitted unchanged)\n");

    /*
     * seteuid() changes only the effective UID.
     * The real UID and saved set-user-ID remain 0.
     * Per Rule 2: effective caps are cleared.
     */
    if (seteuid(1000) == -1) { perror("seteuid(1000)"); return 1; }

    print_cap_summary("After seteuid(1000)");

    /* ================================================================
     * RULE 3 DEMONSTRATION
     * Change effective UID back from non-zero to 0.
     * Expected effect: permitted capability set is COPIED to effective.
     * ================================================================ */
    printf("\n--- Demonstrating Rule 3: EUID nonzero -> 0 ---\n");
    printf("    (Permitted caps should be COPIED to effective)\n");

    /*
     * seteuid(0) is possible here because the saved set-user-ID is still 0.
     * Per Rule 3: effective = permitted (all caps restored to effective).
     */
    if (seteuid(0) == -1) { perror("seteuid(0)"); return 1; }

    print_cap_summary("After seteuid(0) again");

    /* ================================================================
     * RULE 1 DEMONSTRATION
     * Change ALL user IDs to non-zero.
     * Expected effect: BOTH permitted AND effective capability sets cleared.
     * This is IRREVERSIBLE — cannot regain capabilities after this!
     * ================================================================ */
    printf("\n--- Demonstrating Rule 1: ALL UIDs -> nonzero ---\n");
    printf("    (BOTH permitted AND effective caps should be CLEARED)\n");
    printf("    (THIS IS IRREVERSIBLE)\n");

    /*
     * setresuid(real, effective, saved) sets all three UIDs at once.
     * When all three become nonzero:
     *   - Permitted capabilities: CLEARED
     *   - Effective capabilities: CLEARED
     *   - This cannot be undone — the process has permanently dropped all caps.
     */
    if (setresuid(1000, 1000, 1000) == -1) {
        perror("setresuid(1000,1000,1000)");
        return 1;
    }

    print_cap_summary("After setresuid(1000,1000,1000)");

    /* Attempting to regain root would fail because saved set-user-ID is now 1000 */
    printf("\n--- Attempting seteuid(0) now (should fail) ---\n");
    if (seteuid(0) == -1) {
        printf("  seteuid(0) FAILED as expected: %m\n");
        printf("  (All UIDs are nonzero; saved set-user-ID is no longer 0)\n");
    } else {
        printf("  seteuid(0) unexpectedly succeeded\n");
    }

    print_cap_summary("Final state");
    printf("\nProcess has no capabilities and cannot regain them.\n");

    return 0;
}

--- Initial state (root) ---
  [Initial: EUID=0                       ]  RUID=0    EUID=0     caps=[=ep]

--- Demonstrating Rule 2: EUID 0 -> nonzero ---
  [After seteuid(1000)                   ]  RUID=0    EUID=1000  caps=[=p]

--- Demonstrating Rule 3: EUID nonzero -> 0 ---
  [After seteuid(0) again                ]  RUID=0    EUID=0     caps=[=ep]

--- Demonstrating Rule 1: ALL UIDs -> nonzero ---
  [After setresuid(1000,1000,1000)        ]  RUID=1000 EUID=1000  caps=[none]

  seteuid(0) FAILED as expected: Operation not permitted