setuids.bt(8) System Manager's Manual setuids.bt(8)

# [NAME](#NAME)

setuids.bt - Trace setuid family of syscalls. Uses bpftrace/eBPF.

# [SYNOPSIS](#SYNOPSIS)

**setuids.bt**

# [DESCRIPTION](#DESCRIPTION)

This tool traces privilege escalation via setuid syscalls, and can be used for debugging, whitelist creation, and intrusion detection.

It works by tracing the [setuid(2)](/man/enterprise-packages/bpftrace/setuid.2), [setfsuid(2)](/man/enterprise-packages/bpftrace/setfsuid.2), and [retresuid(2)](/man/enterprise-packages/bpftrace/retresuid.2) syscalls using the syscall tracepoints.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bpftrace.

# [EXAMPLES](#EXAMPLES)

[Trace setuid syscalls:](#Trace)

\# **setuids.bt**

# [FIELDS](#FIELDS)

[PID](#PID)

The calling process ID.

[COMM](#COMM)

The calling process (thread) name.

[UID](#UID)

The UID of the caller.

[SYSCALL](#SYSCALL)

The syscall name.

[ARGS](#ARGS)

The arguments to the syscall

(RET)

The return value for the syscall: 0 == success, other numbers indicate an error code.

# [OVERHEAD](#OVERHEAD)

setuid calls are expected to be low frequency (<< 100/s), so the overhead of this tool is expected to be negligible.

# [SOURCE](#SOURCE)

This tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool.

This version is in the bpftrace repository:

https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg

# [SEE ALSO](#SEE_ALSO)

[capable.bt(8)](/man/enterprise-packages/bpftrace/capable.bt.8)

2019-07-05 USER COMMANDS

---

Document: setuids.bt(8) from bpftrace 0.27.0-r1 (Chainguard OS)
Source: https://github.com/bpftrace/bpftrace