UID\_WRAPPER(1)   UID\_WRAPPER(1)

# [NAME](#NAME)

uid\_wrapper - A wrapper to fake privilege separation

# [SYNOPSIS](#SYNOPSIS)

LD\_PRELOAD=libuid\_wrapper.so UID\_WRAPPER=1 UID\_WRAPPER\_ROOT=1 **./myapplication**

# [DESCRIPTION](#DESCRIPTION)

•Allows uid switching as a normal user.

•Start any application making it believe it is running as root.

•Support for user/group changing in the local thread using the syscalls (like glibc).

•More precisely this library intercepts seteuid and related calls, and simulates them in a manner similar to the nss\_wrapper and socket\_wrapper libraries.

Some projects like a file server need privilege separation to be able to switch to the connection user and do file operations. uid\_wrapper convincingly lies to the application letting it believe it is operating as root and even switching between UIDs and GIDs as needed.

# [ENVIRONMENT VARIABLES](#ENVIRONMENT_VARIABLES)

**UID\_WRAPPER**

If you load the uid\_wrapper and enable it with setting UID\_WRAPPER=1 all setuid and setgid will work, even as a normal user.

**UID\_WRAPPER\_ROOT**

It is possible to start your application as fake root with setting UID\_WRAPPER\_ROOT=1.

**UID\_WRAPPER\_DEBUGLEVEL**

If you need to see what is going on in uid\_wrapper itself or try to find a bug, you can enable logging support in uid\_wrapper if you built it with debug symbols.

•0 = ERROR

•1 = WARNING

•2 = DEBUG

•3 = TRACE

**UID\_WRAPPER\_MYUID**

This environment variable can be used to tell uid\_wrapper to let geteuid() return the real (instead of the faked) UID of the user who started the process with uid\_wrapper.

```
uid_t uid;
setenv("UID_WRAPPER_MYUID", "1", 1);
uid = geteuid();
unsetenv("UID_WRAPPER_MYUID");
```

**UID\_WRAPPER\_DISABLE\_DEEPBIND**

This allows you to disable deep binding in uid\_wrapper. This is useful for running valgrind tools or sanitizers like (address, undefined, thread).

# [EXAMPLE](#EXAMPLE)

```
$ LD_PRELOAD=libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT=1 id
uid=0(root) gid=0(root) 0(root)
```

# [WORKAROUNDS](#WORKAROUNDS)

If you need to write code that behaves differently depending on whether uid\_wrapper is enabled or not, for example in cases where you have to file permissions, you can predefine the uid\_wrapper\_enabled() function in your project as follows:

```
bool uid_wrapper_enabled(void)
{


    return false;
}
```

Since uid\_wrapper overloads this function if enabled, you can use it in your code to detect uid\_wrapper.

2015-11-03

---

Document: uid_wrapper(1) from uid_wrapper 1.3.2-r2 (Chainguard OS)
Source: https://git.samba.org/uid_wrapper.git