#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct passwd {
  int /*<<< orphan*/ pw_uid;
  scalar_t__ pw_gid;
  int /*<<< orphan*/ pw_name;
};

/* Variables and functions */
int /*<<< orphan*/ err(int, char *, ...);
struct passwd *getpwnam(char *);
int initgroups(int /*<<< orphan*/, int);
int /*<<< orphan*/ printf(char *, int);
int setgid(scalar_t__);
int setuid(int /*<<< orphan*/);
int system(char *);
int decreasepriv(int debugflag) {
  struct passwd *nobody = NULL;
  int ret;
  nobody = getpwnam("nobody");
  if (nobody == NULL) {
    err(1, "getpwnam(nobody) failed");
  }
  ret = initgroups(nobody->pw_name, (int)nobody->pw_gid);
  if (ret) {
    err(1, "initgroups(%s, %lud) failed", nobody->pw_name, nobody->pw_gid);
  }
  ret = setgid(nobody->pw_gid);
  if (ret) {
    err(1, "setgid(%lud) failed", nobody->pw_gid);
  }
  ret = setuid(nobody->pw_uid);
  if (ret) {
    err(1, "setuid(%lud) failed", nobody->pw_uid);
  }
  ret = system("id");
  if (ret == -1) {
    err(1, "system(id) failed when invoking fork() or waitpid()");
  } else if (ret == 127) {
    err(1, "system(id) failed during execution of shell");
  }
  if (debugflag > 0) {
    printf("debugflag is %d.\n", debugflag);
  }
  return 0;
}


x86 assembly (clang, -O0):
<decreasepriv>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %edi,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
lea    0xe76(%rip),%rdi
call   1050 <getpwnam@plt>
mov    %rax,-0x10(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    11b1 <decreasepriv+0x41>
mov    $0x1,%edi
lea    0xe5d(%rip),%rsi
mov    $0x0,%al
call   1060 <err@plt>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%edi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
mov    %eax,%esi
call   1090 <initgroups@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
je     11f6 <decreasepriv+0x86>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%edx
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rcx
mov    $0x1,%edi
lea    0xe30(%rip),%rsi
mov    $0x0,%al
call   1060 <err@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1070 <setgid@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
je     122b <decreasepriv+0xbb>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
mov    $0x1,%edi
lea    0xe17(%rip),%rsi
mov    $0x0,%al
call   1060 <err@plt>
mov    -0x10(%rbp),%rax
mov    (%rax),%edi
call   1080 <setuid@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
je     125c <decreasepriv+0xec>
mov    -0x10(%rbp),%rax
mov    (%rax),%edx
mov    $0x1,%edi
lea    0xdfa(%rip),%rsi
mov    $0x0,%al
call   1060 <err@plt>
lea    0xe00(%rip),%rdi
call   1030 <system@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0xffffffff,-0x14(%rbp)
jne    128d <decreasepriv+0x11d>
mov    $0x1,%edi
lea    0xde5(%rip),%rsi
mov    $0x0,%al
call   1060 <err@plt>
jmp    12af <decreasepriv+0x13f>
cmpl   $0x7f,-0x14(%rbp)
jne    12aa <decreasepriv+0x13a>
mov    $0x1,%edi
lea    0xdf7(%rip),%rsi
mov    $0x0,%al
call   1060 <err@plt>
jmp    12af <decreasepriv+0x13f>
cmpl   $0x0,-0x4(%rbp)
jle    12c8 <decreasepriv+0x158>
mov    -0x4(%rbp),%esi
lea    0xe03(%rip),%rdi
call   1040 <printf@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<decreasepriv>:
push   %rbp
push   %rbx
push   %rax
mov    %edi,%ebp
lea    0xe84(%rip),%rdi
call   1050 <getpwnam@plt>
mov    %rax,%rbx
test   %rax,%rax
jne    119c <decreasepriv+0x2c>
lea    0xe77(%rip),%rsi
mov    $0x1,%edi
xor    %eax,%eax
call   1060 <err@plt>
mov    0x8(%rbx),%esi
mov    0x10(%rbx),%edi
call   1090 <initgroups@plt>
test   %eax,%eax
je     11c5 <decreasepriv+0x55>
mov    0x10(%rbx),%edx
mov    0x8(%rbx),%rcx
lea    0xe66(%rip),%rsi
mov    $0x1,%edi
xor    %eax,%eax
call   1060 <err@plt>
mov    0x8(%rbx),%rdi
call   1070 <setgid@plt>
test   %eax,%eax
je     11e9 <decreasepriv+0x79>
mov    0x8(%rbx),%rdx
lea    0xe5e(%rip),%rsi
mov    $0x1,%edi
xor    %eax,%eax
call   1060 <err@plt>
mov    (%rbx),%edi
call   1080 <setuid@plt>
test   %eax,%eax
je     1209 <decreasepriv+0x99>
mov    (%rbx),%edx
lea    0xe52(%rip),%rsi
mov    $0x1,%edi
xor    %eax,%eax
call   1060 <err@plt>
lea    0xe53(%rip),%rdi
call   1030 <system@plt>
cmp    $0xffffffff,%eax
je     1228 <decreasepriv+0xb8>
cmp    $0x7f,%eax
jne    123b <decreasepriv+0xcb>
lea    0xe74(%rip),%rsi
jmp    122f <decreasepriv+0xbf>
lea    0xe37(%rip),%rsi
mov    $0x1,%edi
xor    %eax,%eax
call   1060 <err@plt>
test   %ebp,%ebp
jle    124d <decreasepriv+0xdd>
lea    0xe80(%rip),%rdi
mov    %ebp,%esi
call   1040 <printf@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %rbp
ret

LLVM IR (-O0):
%struct.passwd = type { i32, i64, i32 }
@.str = [7 x i8] c"nobody\00"
@.str.1 = [24 x i8] c"getpwnam(nobody) failed\00"
@.str.2 = [28 x i8] c"initgroups(%s, %lud) failed\00"
@.str.3 = [20 x i8] c"setgid(%lud) failed\00"
@.str.4 = [20 x i8] c"setuid(%lud) failed\00"
@.str.5 = [3 x i8] c"id\00"
@.str.6 = [52 x i8] c"system(id) failed when invoking fork() or waitpid()\00"
@.str.7 = [44 x i8] c"system(id) failed during execution of shell\00"
@.str.8 = [18 x i8] c"debugflag is %d.\0A\00"
define i32 @decreasepriv(i32 %0) {
%2 = alloca i32
%3 = alloca %struct.passwd*
%4 = alloca i32
store i32 %0, i32* %2
store %struct.passwd* null, %struct.passwd** %3
%5 = call %struct.passwd* @getpwnam(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
store %struct.passwd* %5, %struct.passwd** %3
%6 = load %struct.passwd*, %struct.passwd** %3
%7 = icmp eq %struct.passwd* %6, null
br i1 %7, label %8, label %10
8: ; preds = %1
%9 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.1, i64 0, i64 0))
br label %10
10: ; preds = %8, %1
%11 = load %struct.passwd*, %struct.passwd** %3
%12 = getelementptr inbounds %struct.passwd, %struct.passwd* %11, i32 0, i32 2
%13 = load i32, i32* %12
%14 = load %struct.passwd*, %struct.passwd** %3
%15 = getelementptr inbounds %struct.passwd, %struct.passwd* %14, i32 0, i32 1
%16 = load i64, i64* %15
%17 = trunc i64 %16 to i32
%18 = call i32 @initgroups(i32 %13, i32 %17)
store i32 %18, i32* %4
%19 = load i32, i32* %4
%20 = icmp ne i32 %19, 0
br i1 %20, label %21, label %29
21: ; preds = %10
%22 = load %struct.passwd*, %struct.passwd** %3
%23 = getelementptr inbounds %struct.passwd, %struct.passwd* %22, i32 0, i32 2
%24 = load i32, i32* %23
%25 = load %struct.passwd*, %struct.passwd** %3
%26 = getelementptr inbounds %struct.passwd, %struct.passwd* %25, i32 0, i32 1
%27 = load i64, i64* %26
%28 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.2, i64 0, i64 0), i32 %24, i64 %27)
br label %29
29: ; preds = %21, %10
%30 = load %struct.passwd*, %struct.passwd** %3
%31 = getelementptr inbounds %struct.passwd, %struct.passwd* %30, i32 0, i32 1
%32 = load i64, i64* %31
%33 = call i32 @setgid(i64 %32)
store i32 %33, i32* %4
%34 = load i32, i32* %4
%35 = icmp ne i32 %34, 0
br i1 %35, label %36, label %41
36: ; preds = %29
%37 = load %struct.passwd*, %struct.passwd** %3
%38 = getelementptr inbounds %struct.passwd, %struct.passwd* %37, i32 0, i32 1
%39 = load i64, i64* %38
%40 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.3, i64 0, i64 0), i64 %39)
br label %41
41: ; preds = %36, %29
%42 = load %struct.passwd*, %struct.passwd** %3
%43 = getelementptr inbounds %struct.passwd, %struct.passwd* %42, i32 0, i32 0
%44 = load i32, i32* %43
%45 = call i32 @setuid(i32 %44)
store i32 %45, i32* %4
%46 = load i32, i32* %4
%47 = icmp ne i32 %46, 0
br i1 %47, label %48, label %53
48: ; preds = %41
%49 = load %struct.passwd*, %struct.passwd** %3
%50 = getelementptr inbounds %struct.passwd, %struct.passwd* %49, i32 0, i32 0
%51 = load i32, i32* %50
%52 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.4, i64 0, i64 0), i32 %51)
br label %53
53: ; preds = %48, %41
%54 = call i32 @system(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
store i32 %54, i32* %4
%55 = load i32, i32* %4
%56 = icmp eq i32 %55, -1
br i1 %56, label %57, label %59
57: ; preds = %53
%58 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([52 x i8], [52 x i8]* @.str.6, i64 0, i64 0))
br label %65
59: ; preds = %53
%60 = load i32, i32* %4
%61 = icmp eq i32 %60, 127
br i1 %61, label %62, label %64
62: ; preds = %59
%63 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.7, i64 0, i64 0))
br label %64
64: ; preds = %62, %59
br label %65
65: ; preds = %64, %57
%66 = load i32, i32* %2
%67 = icmp sgt i32 %66, 0
br i1 %67, label %68, label %71
68: ; preds = %65
%69 = load i32, i32* %2
%70 = call i32 @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.8, i64 0, i64 0), i32 %69)
br label %71
71: ; preds = %68, %65
ret i32 0
}

LLVM IR (-O2):
%struct.passwd = type { i32, i64, i32 }
@.str = [7 x i8] c"nobody\00"
@.str.1 = [24 x i8] c"getpwnam(nobody) failed\00"
@.str.2 = [28 x i8] c"initgroups(%s, %lud) failed\00"
@.str.3 = [20 x i8] c"setgid(%lud) failed\00"
@.str.4 = [20 x i8] c"setuid(%lud) failed\00"
@.str.5 = [3 x i8] c"id\00"
@.str.6 = [52 x i8] c"system(id) failed when invoking fork() or waitpid()\00"
@.str.7 = [44 x i8] c"system(id) failed during execution of shell\00"
@.str.8 = [18 x i8] c"debugflag is %d.\0A\00"
define i32 @decreasepriv(i32 %0) {
%2 = tail call %struct.passwd* @getpwnam(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%3 = icmp eq %struct.passwd* %2, null
br i1 %3, label %4, label %6
4: ; preds = %1
%5 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.1, i64 0, i64 0))
br label %6
6: ; preds = %4, %1
%7 = getelementptr inbounds %struct.passwd, %struct.passwd* %2, i64 0, i32 2
%8 = load i32, i32* %7
%9 = getelementptr inbounds %struct.passwd, %struct.passwd* %2, i64 0, i32 1
%10 = load i64, i64* %9
%11 = trunc i64 %10 to i32
%12 = tail call i32 @initgroups(i32 %8, i32 %11)
%13 = icmp eq i32 %12, 0
br i1 %13, label %18, label %14
14: ; preds = %6
%15 = load i32, i32* %7
%16 = load i64, i64* %9
%17 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.2, i64 0, i64 0), i32 %15, i64 %16)
br label %18
18: ; preds = %14, %6
%19 = load i64, i64* %9
%20 = tail call i32 @setgid(i64 %19)
%21 = icmp eq i32 %20, 0
br i1 %21, label %25, label %22
22: ; preds = %18
%23 = load i64, i64* %9
%24 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.3, i64 0, i64 0), i64 %23)
br label %25
25: ; preds = %22, %18
%26 = getelementptr inbounds %struct.passwd, %struct.passwd* %2, i64 0, i32 0
%27 = load i32, i32* %26
%28 = tail call i32 @setuid(i32 %27)
%29 = icmp eq i32 %28, 0
br i1 %29, label %33, label %30
30: ; preds = %25
%31 = load i32, i32* %26
%32 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.4, i64 0, i64 0), i32 %31)
br label %33
33: ; preds = %30, %25
%34 = tail call i32 @system(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
switch i32 %34, label %39 [
i32 -1, label %36
i32 127, label %35
]
35: ; preds = %33
br label %36
36: ; preds = %33, %35
%37 = phi i8* [ getelementptr inbounds ([44 x i8], [44 x i8]* @.str.7, i64 0, i64 0), %35 ], [ getelementptr inbounds ([52 x i8], [52 x i8]* @.str.6, i64 0, i64 0), %33 ]
%38 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* %37)
br label %39
39: ; preds = %36, %33
%40 = icmp sgt i32 %0, 0
br i1 %40, label %41, label %43
41: ; preds = %39
%42 = tail call i32 @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.8, i64 0, i64 0), i32 %0)
br label %43
43: ; preds = %41, %39
ret i32 0
}