#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct dirent {
  char *d_name;
};
typedef scalar_t__ pid_t;
typedef int /*<<< orphan*/ FILE;
typedef int /*<<< orphan*/ DIR;

/* Variables and functions */
int EXIT_SUCCESS;
scalar_t__ chdir(char *);
int /*<<< orphan*/ closedir(int /*<<< orphan*/ *);
int /*<<< orphan*/ errno;
int /*<<< orphan*/ error(int, int /*<<< orphan*/, char *, ...);
int /*<<< orphan*/ execl(char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ execvp(char *, char **);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
scalar_t__ fork();
int /*<<< orphan*/ free(char *);
scalar_t__ getdelim(char **, size_t *, char, int /*<<< orphan*/ *);
scalar_t__ getegid();
char *getenv(char *);
scalar_t__ geteuid();
scalar_t__ getgid();
scalar_t__ getparent(scalar_t__);
scalar_t__ getuid();
int /*<<< orphan*/ join(scalar_t__, char *);
int /*<<< orphan*/ *opendir(char *);
struct dirent *readdir(int /*<<< orphan*/ *);
int /*<<< orphan*/ setgid(int /*<<< orphan*/);
int /*<<< orphan*/ setgroups(int /*<<< orphan*/, int /*<<< orphan*/ *);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
scalar_t__ strcmp(char *, char *);
char *string(char *, scalar_t__);
scalar_t__ strtol(char *, char **, int);
int /*<<< orphan*/ usage(char *);
int /*<<< orphan*/ waitforexit(scalar_t__);
int main(int argc, char **argv) {
  char *end, *item = NULL, *path;
  pid_t child = -1, parent, pid;
  size_t size;
  struct dirent *entry;
  DIR *dir;
  FILE *file;
  if (argc < 2)
    usage(argv[0]);
  parent = strtol(argv[1], &end, 10);
  if (end == argv[1] || *end)
    usage(argv[0]);
  if (geteuid() != getuid())
    error(1, 0, "setuid installation is unsafe");
  else if (getegid() != getgid())
    error(1, 0, "setgid installation is unsafe");
  join(parent, "user");
  setgid(0);
  setgroups(0, NULL);
  setuid(0);
  if (!(dir = opendir("/proc")))
    error(1, 0, "Failed to list processes");
  while (child < 0 && (entry = readdir(dir))) {
    pid = strtol(entry->d_name, &end, 10);
    if (end == entry->d_name || *end)
      continue;
    if (getparent(pid) == parent) {
      path = string("/proc/%u/environ", pid);
      if ((file = fopen(path, "r"))) {
        while (getdelim(&item, &size, '\0', file) >= 0)
          if (strcmp(item, "container=contain") == 0)
            child = pid;
        fclose(file);
      }
      free(path);
    }
  }
  closedir(dir);
  if (item)
    free(item);
  if (child < 0)
    error(1, 0, "PID %u is not a container supervisor", parent);
  join(child, "ipc");
  join(child, "net");
  join(child, "pid");
  join(child, "uts");
  join(child, "mnt");
  if (chdir("/") < 0)
    error(1, 0, "Failed to enter container root directory");
  switch (child = fork()) {
  case -1:
    error(1, errno, "fork");
  case 0:
    if (argv[2])
      execvp(argv[2], argv + 2);
    else if (getenv("SHELL"))
      execl(getenv("SHELL"), getenv("SHELL"), NULL);
    else
      execl("/bin/sh", "/bin/sh", NULL);
    error(1, errno, "exec");
  }
  waitforexit(child);
  return EXIT_SUCCESS;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movq   $0x0,-0x20(%rbp)
movq   $0xffffffffffffffff,-0x30(%rbp)
ff
cmpl   $0x2,-0x8(%rbp)
jge    12ef <main+0x3f>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
call   1140 <usage@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    -0x18(%rbp),%rsi
mov    $0xa,%edx
call   10f0 <strtol@plt>
mov    %rax,-0x38(%rbp)
mov    -0x18(%rbp),%rax
mov    -0x10(%rbp),%rcx
cmp    0x8(%rcx),%rax
je     132b <main+0x7b>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x0,%eax
je     1337 <main+0x87>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
call   1140 <usage@plt>
mov    $0x0,%al
call   10b0 <geteuid@plt>
mov    %rax,-0x68(%rbp)
mov    $0x0,%al
call   1080 <getuid@plt>
mov    %rax,%rcx
mov    -0x68(%rbp),%rax
cmp    %rcx,%rax
je     1373 <main+0xc3>
mov    $0x1,%edi
xor    %esi,%esi
lea    0xc99(%rip),%rdx
mov    $0x0,%al
call   1150 <error@plt>
jmp    13af <main+0xff>
mov    $0x0,%al
call   1130 <getegid@plt>
mov    %rax,-0x70(%rbp)
mov    $0x0,%al
call   1100 <getgid@plt>
mov    %rax,%rcx
mov    -0x70(%rbp),%rax
cmp    %rcx,%rax
je     13aa <main+0xfa>
mov    $0x1,%edi
xor    %esi,%esi
lea    0xc7b(%rip),%rdx
mov    $0x0,%al
call   1150 <error@plt>
jmp    13af <main+0xff>
mov    -0x38(%rbp),%rdi
lea    0xc82(%rip),%rsi
call   11a0 <join@plt>
xor    %edi,%edi
call   1160 <setgid@plt>
xor    %edi,%edi
xor    %eax,%eax
mov    %eax,%esi
call   10c0 <setgroups@plt>
xor    %edi,%edi
call   1190 <setuid@plt>
lea    0xc62(%rip),%rdi
call   1060 <opendir@plt>
mov    %rax,-0x58(%rbp)
cmp    $0x0,%rax
jne    1407 <main+0x157>
mov    $0x1,%edi
xor    %esi,%esi
lea    0xc47(%rip),%rdx
mov    $0x0,%al
call   1150 <error@plt>
jmp    140c <main+0x15c>
xor    %eax,%eax
cmpq   $0x0,-0x30(%rbp)
mov    %al,-0x71(%rbp)
jge    1433 <main+0x183>
mov    -0x58(%rbp),%rdi
call   1110 <readdir@plt>
mov    %rax,-0x50(%rbp)
cmp    $0x0,%rax
setne  %al
mov    %al,-0x71(%rbp)
mov    -0x71(%rbp),%al
test   $0x1,%al
jne    1443 <main+0x193>
jmp    1527 <main+0x277>
mov    -0x50(%rbp),%rax
mov    (%rax),%rdi
lea    -0x18(%rbp),%rsi
mov    $0xa,%edx
call   10f0 <strtol@plt>
mov    %rax,-0x40(%rbp)
mov    -0x18(%rbp),%rax
mov    -0x50(%rbp),%rcx
cmp    (%rcx),%rax
je     147d <main+0x1cd>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x0,%eax
je     1482 <main+0x1d2>
jmp    140c <main+0x15c>
mov    -0x40(%rbp),%rdi
call   1120 <getparent@plt>
cmp    -0x38(%rbp),%rax
jne    1522 <main+0x272>
mov    -0x40(%rbp),%rsi
lea    0xbc0(%rip),%rdi
call   10a0 <string@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rdi
lea    0xb8b(%rip),%rsi
call   1170 <fopen@plt>
mov    %rax,-0x60(%rbp)
cmp    $0x0,%rax
je     1519 <main+0x269>
jmp    14cc <main+0x21c>
mov    -0x60(%rbp),%rcx
lea    -0x20(%rbp),%rdi
lea    -0x48(%rbp),%rsi
xor    %edx,%edx
call   11c0 <getdelim@plt>
cmp    $0x0,%rax
jl     1510 <main+0x260>
mov    -0x20(%rbp),%rdi
lea    0xb7d(%rip),%rsi
call   10e0 <strcmp@plt>
cmp    $0x0,%rax
jne    150b <main+0x25b>
mov    -0x40(%rbp),%rax
mov    %rax,-0x30(%rbp)
jmp    14cc <main+0x21c>
mov    -0x60(%rbp),%rdi
call   1050 <fclose@plt>
mov    -0x28(%rbp),%rdi
call   1040 <free@plt>
jmp    140c <main+0x15c>
mov    -0x58(%rbp),%rdi
call   10d0 <closedir@plt>
cmpq   $0x0,-0x20(%rbp)
je     1544 <main+0x294>
mov    -0x20(%rbp),%rdi
call   1040 <free@plt>
cmpq   $0x0,-0x30(%rbp)
jge    1568 <main+0x2b8>
mov    -0x38(%rbp),%rcx
mov    $0x1,%edi
xor    %esi,%esi
lea    0xb22(%rip),%rdx
mov    $0x0,%al
call   1150 <error@plt>
mov    -0x30(%rbp),%rdi
lea    0xb35(%rip),%rsi
call   11a0 <join@plt>
mov    -0x30(%rbp),%rdi
lea    0xb29(%rip),%rsi
call   11a0 <join@plt>
mov    -0x30(%rbp),%rdi
lea    0xb1d(%rip),%rsi
call   11a0 <join@plt>
mov    -0x30(%rbp),%rdi
lea    0xb11(%rip),%rsi
call   11a0 <join@plt>
mov    -0x30(%rbp),%rdi
lea    0xb05(%rip),%rsi
call   11a0 <join@plt>
lea    0xafd(%rip),%rdi
call   1070 <chdir@plt>
cmp    $0x0,%rax
jge    15e3 <main+0x333>
mov    $0x1,%edi
xor    %esi,%esi
lea    0xae2(%rip),%rdx
mov    $0x0,%al
call   1150 <error@plt>
xor    %eax,%eax
call   11d0 <fork@plt>
mov    %rax,-0x30(%rbp)
mov    %rax,%rcx
mov    %rcx,-0x80(%rbp)
sub    $0xffffffffffffffff,%rax
je     1616 <main+0x366>
jmp    1604 <main+0x354>
mov    -0x80(%rbp),%rax
test   %rax,%rax
je     1632 <main+0x382>
jmp    16dc <main+0x42c>
mov    0x29c3(%rip),%rax
mov    (%rax),%esi
mov    $0x1,%edi
lea    0xabc(%rip),%rdx
mov    $0x0,%al
call   1150 <error@plt>
mov    -0x10(%rbp),%rax
cmpq   $0x0,0x10(%rax)
je     165b <main+0x3ab>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
mov    -0x10(%rbp),%rsi
add    $0x10,%rsi
call   1180 <execvp@plt>
jmp    16c0 <main+0x410>
lea    0xa8a(%rip),%rdi
call   1030 <getenv@plt>
cmp    $0x0,%rax
je     16a8 <main+0x3f8>
lea    0xa74(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,-0x88(%rbp)
lea    0xa61(%rip),%rdi
call   1030 <getenv@plt>
mov    -0x88(%rbp),%rdi
mov    %rax,%rsi
xor    %eax,%eax
mov    %eax,%edx
call   11b0 <execl@plt>
jmp    16bb <main+0x40b>
lea    0xa43(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
mov    %rsi,%rdi
call   11b0 <execl@plt>
jmp    16c0 <main+0x410>
mov    0x2919(%rip),%rax
mov    (%rax),%esi
mov    $0x1,%edi
lea    0xa25(%rip),%rdx
mov    $0x0,%al
call   1150 <error@plt>
mov    -0x30(%rbp),%rdi
call   1090 <waitforexit@plt>
mov    0x28ec(%rip),%rax
mov    (%rax),%eax
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
mov    %rsi,%rbp
movq   $0x0,(%rsp)
cmp    $0x1,%edi
jg     12d7 <main+0x27>
mov    0x0(%rbp),%rdi
call   1140 <usage@plt>
mov    0x8(%rbp),%rdi
lea    0x8(%rsp),%rsi
mov    $0xa,%edx
call   10f0 <strtol@plt>
mov    %rax,%r14
mov    0x8(%rsp),%rax
cmp    0x8(%rbp),%rax
je     12fd <main+0x4d>
cmpb   $0x0,(%rax)
je     1306 <main+0x56>
mov    0x0(%rbp),%rdi
call   1140 <usage@plt>
xor    %eax,%eax
call   10b0 <geteuid@plt>
mov    %rax,%rbx
xor    %eax,%eax
call   1080 <getuid@plt>
cmp    %rax,%rbx
jne    133b <main+0x8b>
xor    %eax,%eax
call   1130 <getegid@plt>
mov    %rax,%rbx
xor    %eax,%eax
call   1100 <getgid@plt>
cmp    %rax,%rbx
je     1350 <main+0xa0>
lea    0xce5(%rip),%rdx
jmp    1342 <main+0x92>
lea    0xcbe(%rip),%rdx
mov    $0x1,%edi
xor    %esi,%esi
xor    %eax,%eax
call   1150 <error@plt>
mov    %rbp,0x28(%rsp)
lea    0xce0(%rip),%rsi
mov    %r14,0x18(%rsp)
mov    %r14,%rdi
call   11a0 <join@plt>
xor    %edi,%edi
call   1160 <setgid@plt>
xor    %edi,%edi
xor    %esi,%esi
call   10c0 <setgroups@plt>
xor    %edi,%edi
call   1190 <setuid@plt>
lea    0xcba(%rip),%rdi
call   1060 <opendir@plt>
mov    %rax,%rbx
test   %rax,%rax
jne    13a9 <main+0xf9>
lea    0xcac(%rip),%rdx
mov    $0x1,%edi
xor    %esi,%esi
xor    %eax,%eax
call   1150 <error@plt>
mov    $0xffffffffffffffff,%r12
lea    0x8(%rsp),%r13
mov    %rbx,%rdi
call   1110 <readdir@plt>
test   %rax,%rax
sete   %r14b
je     14c3 <main+0x213>
mov    %rax,%rbp
jmp    13e8 <main+0x138>
nop
mov    %rbx,%rdi
call   1110 <readdir@plt>
mov    %rax,%rbp
test   %rax,%rax
sete   %r14b
je     14c3 <main+0x213>
mov    0x0(%rbp),%rdi
mov    %r13,%rsi
mov    $0xa,%edx
call   10f0 <strtol@plt>
mov    %rax,%r15
mov    0x8(%rsp),%rax
cmp    0x0(%rbp),%rax
je     13d0 <main+0x120>
cmpb   $0x0,(%rax)
jne    13d0 <main+0x120>
mov    %r15,%rdi
call   1120 <getparent@plt>
cmp    0x18(%rsp),%rax
jne    14ba <main+0x20a>
lea    0xc3a(%rip),%rdi
mov    %r15,%rsi
call   10a0 <string@plt>
mov    %rax,%rbp
mov    %rax,%rdi
lea    0xc04(%rip),%rsi
call   1170 <fopen@plt>
test   %rax,%rax
je     14b2 <main+0x202>
mov    %rsp,%rdi
lea    0x30(%rsp),%rsi
xor    %edx,%edx
mov    %rax,0x10(%rsp)
mov    %rax,%rcx
call   11c0 <getdelim@plt>
test   %rax,%rax
mov    %rbp,0x20(%rsp)
js     14a0 <main+0x1f0>
mov    0x10(%rsp),%rbp
nopl   0x0(%rax,%rax,1)
mov    (%rsp),%rdi
lea    0xbf6(%rip),%rsi
call   10e0 <strcmp@plt>
test   %rax,%rax
cmove  %r15,%r12
mov    %rsp,%rdi
lea    0x30(%rsp),%rsi
xor    %edx,%edx
mov    %rbp,%rcx
call   11c0 <getdelim@plt>
test   %rax,%rax
jns    1470 <main+0x1c0>
jmp    14a5 <main+0x1f5>
mov    0x10(%rsp),%rbp
mov    %rbp,%rdi
call   1050 <fclose@plt>
mov    0x20(%rsp),%rbp
mov    %rbp,%rdi
call   1040 <free@plt>
test   %r12,%r12
js     13b5 <main+0x105>
mov    %rbx,%rdi
call   10d0 <closedir@plt>
mov    (%rsp),%rdi
test   %rdi,%rdi
je     14d9 <main+0x229>
call   1040 <free@plt>
test   $0x1,%r14b
je     14f9 <main+0x249>
lea    0xb9d(%rip),%rdx
mov    $0x1,%edi
xor    %esi,%esi
mov    0x18(%rsp),%rcx
xor    %eax,%eax
call   1150 <error@plt>
lea    0xba8(%rip),%rsi
mov    %r12,%rdi
call   11a0 <join@plt>
lea    0xb9d(%rip),%rsi
mov    %r12,%rdi
call   11a0 <join@plt>
lea    0xb92(%rip),%rsi
mov    %r12,%rdi
call   11a0 <join@plt>
lea    0xb87(%rip),%rsi
mov    %r12,%rdi
call   11a0 <join@plt>
lea    0xb7c(%rip),%rsi
mov    %r12,%rdi
call   11a0 <join@plt>
lea    0xb71(%rip),%rdi
call   1070 <chdir@plt>
test   %rax,%rax
mov    0x28(%rsp),%rbp
jns    156f <main+0x2bf>
lea    0xb5d(%rip),%rdx
mov    $0x1,%edi
xor    %esi,%esi
xor    %eax,%eax
call   1150 <error@plt>
xor    %eax,%eax
call   11d0 <fork@plt>
mov    %rax,%rbx
test   %rax,%rax
je     15a0 <main+0x2f0>
cmp    $0xffffffffffffffff,%rbx
jne    15fd <main+0x34d>
mov    0x2a55(%rip),%rax
mov    (%rax),%esi
lea    0xb53(%rip),%rdx
mov    $0x1,%edi
xor    %eax,%eax
call   1150 <error@plt>
mov    0x10(%rbp),%rdi
test   %rdi,%rdi
je     15b7 <main+0x307>
add    $0x10,%rbp
mov    %rbp,%rsi
call   1180 <execvp@plt>
jmp    15e1 <main+0x331>
lea    0xb2e(%rip),%rdi
call   1030 <getenv@plt>
test   %rax,%rax
je     15d0 <main+0x320>
mov    %rax,%rdi
mov    %rax,%rsi
jmp    15da <main+0x32a>
lea    0xb1b(%rip),%rdi
mov    %rdi,%rsi
xor    %edx,%edx
call   11b0 <execl@plt>
mov    0x29f8(%rip),%rax
mov    (%rax),%esi
lea    0xb09(%rip),%rdx
mov    $0x1,%edi
xor    %eax,%eax
call   1150 <error@plt>
mov    %rbx,%rdi
call   1090 <waitforexit@plt>
mov    0x29cc(%rip),%rax
mov    (%rax),%eax
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.dirent = type { i8* }
@.str = [30 x i8] c"setuid installation is unsafe\00"
@.str.1 = [30 x i8] c"setgid installation is unsafe\00"
@.str.2 = [5 x i8] c"user\00"
@.str.3 = [6 x i8] c"/proc\00"
@.str.4 = [25 x i8] c"Failed to list processes\00"
@.str.5 = [17 x i8] c"/proc/%u/environ\00"
@.str.6 = [2 x i8] c"r\00"
@.str.7 = [18 x i8] c"container=contain\00"
@.str.8 = [37 x i8] c"PID %u is not a container supervisor\00"
@.str.9 = [4 x i8] c"ipc\00"
@.str.10 = [4 x i8] c"net\00"
@.str.11 = [4 x i8] c"pid\00"
@.str.12 = [4 x i8] c"uts\00"
@.str.13 = [4 x i8] c"mnt\00"
@.str.14 = [2 x i8] c"/\00"
@.str.15 = [41 x i8] c"Failed to enter container root directory\00"
@errno = global i32 0
@.str.16 = [5 x i8] c"fork\00"
@.str.17 = [6 x i8] c"SHELL\00"
@.str.18 = [8 x i8] c"/bin/sh\00"
@.str.19 = [5 x i8] c"exec\00"
@EXIT_SUCCESS = global i32 0
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i64
%10 = alloca i64
%11 = alloca i64
%12 = alloca i64
%13 = alloca %struct.dirent*
%14 = alloca i32*
%15 = alloca i32*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i8* null, i8** %7
store i64 -1, i64* %9
%16 = load i32, i32* %4
%17 = icmp slt i32 %16, 2
br i1 %17, label %18, label %23
18: ; preds = %2
%19 = load i8**, i8*** %5
%20 = getelementptr inbounds i8*, i8** %19, i64 0
%21 = load i8*, i8** %20
%22 = call i32 @usage(i8* %21)
br label %23
23: ; preds = %18, %2
%24 = load i8**, i8*** %5
%25 = getelementptr inbounds i8*, i8** %24, i64 1
%26 = load i8*, i8** %25
%27 = call i64 @strtol(i8* %26, i8** %6, i32 10)
store i64 %27, i64* %10
%28 = load i8*, i8** %6
%29 = load i8**, i8*** %5
%30 = getelementptr inbounds i8*, i8** %29, i64 1
%31 = load i8*, i8** %30
%32 = icmp eq i8* %28, %31
br i1 %32, label %38, label %33
33: ; preds = %23
%34 = load i8*, i8** %6
%35 = load i8, i8* %34
%36 = sext i8 %35 to i32
%37 = icmp ne i32 %36, 0
br i1 %37, label %38, label %43
38: ; preds = %33, %23
%39 = load i8**, i8*** %5
%40 = getelementptr inbounds i8*, i8** %39, i64 0
%41 = load i8*, i8** %40
%42 = call i32 @usage(i8* %41)
br label %43
43: ; preds = %38, %33
%44 = call i64 (...) @geteuid()
%45 = call i64 (...) @getuid()
%46 = icmp ne i64 %44, %45
br i1 %46, label %47, label %49
47: ; preds = %43
%48 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0))
br label %56
49: ; preds = %43
%50 = call i64 (...) @getegid()
%51 = call i64 (...) @getgid()
%52 = icmp ne i64 %50, %51
br i1 %52, label %53, label %55
53: ; preds = %49
%54 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.1, i64 0, i64 0))
br label %55
55: ; preds = %53, %49
br label %56
56: ; preds = %55, %47
%57 = load i64, i64* %10
%58 = call i32 @join(i64 %57, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0))
%59 = call i32 @setgid(i32 0)
%60 = call i32 @setgroups(i32 0, i32* null)
%61 = call i32 @setuid(i32 0)
%62 = call i32* @opendir(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0))
store i32* %62, i32** %14
%63 = icmp ne i32* %62, null
br i1 %63, label %66, label %64
64: ; preds = %56
%65 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.4, i64 0, i64 0))
br label %66
66: ; preds = %64, %56
br label %67
67: ; preds = %121, %91, %66
%68 = load i64, i64* %9
%69 = icmp slt i64 %68, 0
br i1 %69, label %70, label %74
70: ; preds = %67
%71 = load i32*, i32** %14
%72 = call %struct.dirent* @readdir(i32* %71)
store %struct.dirent* %72, %struct.dirent** %13
%73 = icmp ne %struct.dirent* %72, null
br label %74
74: ; preds = %70, %67
%75 = phi i1 [ false, %67 ], [ %73, %70 ]
br i1 %75, label %76, label %122
76: ; preds = %74
%77 = load %struct.dirent*, %struct.dirent** %13
%78 = getelementptr inbounds %struct.dirent, %struct.dirent* %77, i32 0, i32 0
%79 = load i8*, i8** %78
%80 = call i64 @strtol(i8* %79, i8** %6, i32 10)
store i64 %80, i64* %11
%81 = load i8*, i8** %6
%82 = load %struct.dirent*, %struct.dirent** %13
%83 = getelementptr inbounds %struct.dirent, %struct.dirent* %82, i32 0, i32 0
%84 = load i8*, i8** %83
%85 = icmp eq i8* %81, %84
br i1 %85, label %91, label %86
86: ; preds = %76
%87 = load i8*, i8** %6
%88 = load i8, i8* %87
%89 = sext i8 %88 to i32
%90 = icmp ne i32 %89, 0
br i1 %90, label %91, label %92
91: ; preds = %86, %76
br label %67
92: ; preds = %86
%93 = load i64, i64* %11
%94 = call i64 @getparent(i64 %93)
%95 = load i64, i64* %10
%96 = icmp eq i64 %94, %95
br i1 %96, label %97, label %121
97: ; preds = %92
%98 = load i64, i64* %11
%99 = call i8* @string(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.5, i64 0, i64 0), i64 %98)
store i8* %99, i8** %8
%100 = load i8*, i8** %8
%101 = call i32* @fopen(i8* %100, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0))
store i32* %101, i32** %15
%102 = icmp ne i32* %101, null
br i1 %102, label %103, label %118
103: ; preds = %97
br label %104
104: ; preds = %114, %103
%105 = load i32*, i32** %15
%106 = call i64 @getdelim(i8** %7, i64* %12, i8 signext 0, i32* %105)
%107 = icmp sge i64 %106, 0
br i1 %107, label %108, label %115
108: ; preds = %104
%109 = load i8*, i8** %7
%110 = call i64 @strcmp(i8* %109, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.7, i64 0, i64 0))
%111 = icmp eq i64 %110, 0
br i1 %111, label %112, label %114
112: ; preds = %108
%113 = load i64, i64* %11
store i64 %113, i64* %9
br label %114
114: ; preds = %112, %108
br label %104
115: ; preds = %104
%116 = load i32*, i32** %15
%117 = call i32 @fclose(i32* %116)
br label %118
118: ; preds = %115, %97
%119 = load i8*, i8** %8
%120 = call i32 @free(i8* %119)
br label %121
121: ; preds = %118, %92
br label %67
122: ; preds = %74
%123 = load i32*, i32** %14
%124 = call i32 @closedir(i32* %123)
%125 = load i8*, i8** %7
%126 = icmp ne i8* %125, null
br i1 %126, label %127, label %130
127: ; preds = %122
%128 = load i8*, i8** %7
%129 = call i32 @free(i8* %128)
br label %130
130: ; preds = %127, %122
%131 = load i64, i64* %9
%132 = icmp slt i64 %131, 0
br i1 %132, label %133, label %136
133: ; preds = %130
%134 = load i64, i64* %10
%135 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.8, i64 0, i64 0), i64 %134)
br label %136
136: ; preds = %133, %130
%137 = load i64, i64* %9
%138 = call i32 @join(i64 %137, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.9, i64 0, i64 0))
%139 = load i64, i64* %9
%140 = call i32 @join(i64 %139, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.10, i64 0, i64 0))
%141 = load i64, i64* %9
%142 = call i32 @join(i64 %141, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.11, i64 0, i64 0))
%143 = load i64, i64* %9
%144 = call i32 @join(i64 %143, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.12, i64 0, i64 0))
%145 = load i64, i64* %9
%146 = call i32 @join(i64 %145, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.13, i64 0, i64 0))
%147 = call i64 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.14, i64 0, i64 0))
%148 = icmp slt i64 %147, 0
br i1 %148, label %149, label %151
149: ; preds = %136
%150 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.15, i64 0, i64 0))
br label %151
151: ; preds = %149, %136
%152 = call i64 (...) @fork()
store i64 %152, i64* %9
switch i64 %152, label %181 [
i64 -1, label %153
i64 0, label %156
]
153: ; preds = %151
%154 = load i32, i32* @errno
%155 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 %154, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.16, i64 0, i64 0))
br label %156
156: ; preds = %151, %153
%157 = load i8**, i8*** %5
%158 = getelementptr inbounds i8*, i8** %157, i64 2
%159 = load i8*, i8** %158
%160 = icmp ne i8* %159, null
br i1 %160, label %161, label %168
161: ; preds = %156
%162 = load i8**, i8*** %5
%163 = getelementptr inbounds i8*, i8** %162, i64 2
%164 = load i8*, i8** %163
%165 = load i8**, i8*** %5
%166 = getelementptr inbounds i8*, i8** %165, i64 2
%167 = call i32 @execvp(i8* %164, i8** %166)
br label %178
168: ; preds = %156
%169 = call i8* @getenv(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.17, i64 0, i64 0))
%170 = icmp ne i8* %169, null
br i1 %170, label %171, label %175
171: ; preds = %168
%172 = call i8* @getenv(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.17, i64 0, i64 0))
%173 = call i8* @getenv(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.17, i64 0, i64 0))
%174 = call i32 @execl(i8* %172, i8* %173, i32* null)
br label %177
175: ; preds = %168
%176 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.18, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.18, i64 0, i64 0), i32* null)
br label %177
177: ; preds = %175, %171
br label %178
178: ; preds = %177, %161
%179 = load i32, i32* @errno
%180 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 %179, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.19, i64 0, i64 0))
br label %181
181: ; preds = %178, %151
%182 = load i64, i64* %9
%183 = call i32 @waitforexit(i64 %182)
%184 = load i32, i32* @EXIT_SUCCESS
ret i32 %184
}

LLVM IR (-O2):
%struct.dirent = type { i8* }
@.str = [30 x i8] c"setuid installation is unsafe\00"
@.str.1 = [30 x i8] c"setgid installation is unsafe\00"
@.str.2 = [5 x i8] c"user\00"
@.str.3 = [6 x i8] c"/proc\00"
@.str.4 = [25 x i8] c"Failed to list processes\00"
@.str.5 = [17 x i8] c"/proc/%u/environ\00"
@.str.6 = [2 x i8] c"r\00"
@.str.7 = [18 x i8] c"container=contain\00"
@.str.8 = [37 x i8] c"PID %u is not a container supervisor\00"
@.str.9 = [4 x i8] c"ipc\00"
@.str.10 = [4 x i8] c"net\00"
@.str.11 = [4 x i8] c"pid\00"
@.str.12 = [4 x i8] c"uts\00"
@.str.13 = [4 x i8] c"mnt\00"
@.str.14 = [2 x i8] c"/\00"
@.str.15 = [41 x i8] c"Failed to enter container root directory\00"
@errno = global i32 0
@.str.16 = [5 x i8] c"fork\00"
@.str.17 = [6 x i8] c"SHELL\00"
@.str.18 = [8 x i8] c"/bin/sh\00"
@.str.19 = [5 x i8] c"exec\00"
@EXIT_SUCCESS = global i32 0
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca i64
%6 = bitcast i8** %3 to i8*
%7 = bitcast i8** %4 to i8*
store i8* null, i8** %4
%8 = bitcast i64* %5 to i8*
%9 = icmp slt i32 %0, 2
br i1 %9, label %10, label %13
10: ; preds = %2
%11 = load i8*, i8** %1
%12 = tail call i32 @usage(i8* %11)
br label %13
13: ; preds = %10, %2
%14 = getelementptr inbounds i8*, i8** %1, i64 1
%15 = load i8*, i8** %14
%16 = call i64 @strtol(i8* %15, i8** %3, i32 10)
%17 = load i8*, i8** %3
%18 = load i8*, i8** %14
%19 = icmp eq i8* %17, %18
br i1 %19, label %23, label %20
20: ; preds = %13
%21 = load i8, i8* %17
%22 = icmp eq i8 %21, 0
br i1 %22, label %26, label %23
23: ; preds = %20, %13
%24 = load i8*, i8** %1
%25 = tail call i32 @usage(i8* %24)
br label %26
26: ; preds = %23, %20
%27 = tail call i64 (...) @geteuid()
%28 = tail call i64 (...) @getuid()
%29 = icmp eq i64 %27, %28
br i1 %29, label %30, label %34
30: ; preds = %26
%31 = tail call i64 (...) @getegid()
%32 = tail call i64 (...) @getgid()
%33 = icmp eq i64 %31, %32
br i1 %33, label %37, label %34
34: ; preds = %30, %26
%35 = phi i8* [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0), %26 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.1, i64 0, i64 0), %30 ]
%36 = tail call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* %35)
br label %37
37: ; preds = %34, %30
%38 = tail call i32 @join(i64 %16, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0))
%39 = tail call i32 @setgid(i32 0)
%40 = tail call i32 @setgroups(i32 0, i32* null)
%41 = tail call i32 @setuid(i32 0)
%42 = tail call i32* @opendir(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0))
%43 = icmp eq i32* %42, null
br i1 %43, label %44, label %46
44: ; preds = %37
%45 = tail call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.4, i64 0, i64 0))
br label %46
46: ; preds = %44, %37
br label %47
47: ; preds = %46, %90
%48 = phi i64 [ %91, %90 ], [ -1, %46 ]
%49 = call %struct.dirent* @readdir(i32* %42)
%50 = icmp eq %struct.dirent* %49, null
br i1 %50, label %93, label %51
51: ; preds = %47, %63
%52 = phi i1 [ %65, %63 ], [ %50, %47 ]
%53 = phi %struct.dirent* [ %64, %63 ], [ %49, %47 ]
%54 = getelementptr inbounds %struct.dirent, %struct.dirent* %53, i64 0, i32 0
%55 = load i8*, i8** %54
%56 = call i64 @strtol(i8* %55, i8** %3, i32 10)
%57 = load i8*, i8** %3
%58 = load i8*, i8** %54
%59 = icmp eq i8* %57, %58
br i1 %59, label %63, label %60
60: ; preds = %51
%61 = load i8, i8* %57
%62 = icmp eq i8 %61, 0
br i1 %62, label %66, label %63
63: ; preds = %60, %51
%64 = call %struct.dirent* @readdir(i32* %42)
%65 = icmp eq %struct.dirent* %64, null
br i1 %65, label %93, label %51
66: ; preds = %60
%67 = call i64 @getparent(i64 %56)
%68 = icmp eq i64 %67, %16
br i1 %68, label %69, label %90
69: ; preds = %66
%70 = call i8* @string(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.5, i64 0, i64 0), i64 %56)
%71 = call i32* @fopen(i8* %70, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0))
%72 = icmp eq i32* %71, null
br i1 %72, label %87, label %73
73: ; preds = %69
%74 = call i64 @getdelim(i8** %4, i64* %5, i8 signext 0, i32* %71)
%75 = icmp sgt i64 %74, -1
br i1 %75, label %76, label %84
76: ; preds = %73, %76
%77 = phi i64 [ %81, %76 ], [ %48, %73 ]
%78 = load i8*, i8** %4
%79 = call i64 @strcmp(i8* %78, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.7, i64 0, i64 0))
%80 = icmp eq i64 %79, 0
%81 = select i1 %80, i64 %56, i64 %77
%82 = call i64 @getdelim(i8** %4, i64* %5, i8 signext 0, i32* %71)
%83 = icmp sgt i64 %82, -1
br i1 %83, label %76, label %84
84: ; preds = %76, %73
%85 = phi i64 [ %48, %73 ], [ %81, %76 ]
%86 = call i32 @fclose(i32* %71)
br label %87
87: ; preds = %84, %69
%88 = phi i64 [ %85, %84 ], [ %48, %69 ]
%89 = call i32 @free(i8* %70)
br label %90
90: ; preds = %87, %66
%91 = phi i64 [ %88, %87 ], [ %48, %66 ]
%92 = icmp slt i64 %91, 0
br i1 %92, label %47, label %93
93: ; preds = %90, %47, %63
%94 = phi i1 [ %65, %63 ], [ %52, %90 ], [ %50, %47 ]
%95 = phi i64 [ %48, %63 ], [ %91, %90 ], [ %48, %47 ]
%96 = call i32 @closedir(i32* %42)
%97 = load i8*, i8** %4
%98 = icmp eq i8* %97, null
br i1 %98, label %101, label %99
99: ; preds = %93
%100 = call i32 @free(i8* %97)
br label %101
101: ; preds = %99, %93
br i1 %94, label %102, label %104
102: ; preds = %101
%103 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.8, i64 0, i64 0), i64 %16)
br label %104
104: ; preds = %102, %101
%105 = call i32 @join(i64 %95, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.9, i64 0, i64 0))
%106 = call i32 @join(i64 %95, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.10, i64 0, i64 0))
%107 = call i32 @join(i64 %95, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.11, i64 0, i64 0))
%108 = call i32 @join(i64 %95, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.12, i64 0, i64 0))
%109 = call i32 @join(i64 %95, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.13, i64 0, i64 0))
%110 = call i64 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.14, i64 0, i64 0))
%111 = icmp slt i64 %110, 0
br i1 %111, label %112, label %114
112: ; preds = %104
%113 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 0, i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.15, i64 0, i64 0))
br label %114
114: ; preds = %112, %104
%115 = call i64 (...) @fork()
switch i64 %115, label %135 [
i64 -1, label %116
i64 0, label %119
]
116: ; preds = %114
%117 = load i32, i32* @errno
%118 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 %117, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.16, i64 0, i64 0))
br label %119
119: ; preds = %114, %116
%120 = getelementptr inbounds i8*, i8** %1, i64 2
%121 = load i8*, i8** %120
%122 = icmp eq i8* %121, null
br i1 %122, label %125, label %123
123: ; preds = %119
%124 = call i32 @execvp(i8* %121, i8** %120)
br label %132
125: ; preds = %119
%126 = call i8* @getenv(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.17, i64 0, i64 0))
%127 = icmp eq i8* %126, null
br i1 %127, label %130, label %128
128: ; preds = %125
%129 = call i32 @execl(i8* %126, i8* %126, i32* null)
br label %132
130: ; preds = %125
%131 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.18, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.18, i64 0, i64 0), i32* null)
br label %132
132: ; preds = %128, %130, %123
%133 = load i32, i32* @errno
%134 = call i32 (i32, i32, i8*, ...) @error(i32 1, i32 %133, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.19, i64 0, i64 0))
br label %135
135: ; preds = %132, %114
%136 = call i32 @waitforexit(i64 %115)
%137 = load i32, i32* @EXIT_SUCCESS
ret i32 %137
}