#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_3__ TYPE_1__;

/* Type definitions */
typedef int /*<<< orphan*/ pid_t;
typedef TYPE_1__ *cap_user_header_t;
typedef void *cap_user_data_t;
struct TYPE_3__ {
  scalar_t__ pid;
  int /*<<< orphan*/ version;
};

/* Variables and functions */
int /*<<< orphan*/ CAP_KILL;
int /*<<< orphan*/ CAP_SETUID;
int /*<<< orphan*/ PR_SET_KEEPCAPS;
int /*<<< orphan*/ SIGKILL;
int _LINUX_CAPABILITY_U32S;
int /*<<< orphan*/ _LINUX_CAPABILITY_VERSION;
int /*<<< orphan*/ add_cap(void *, int /*<<< orphan*/);
int /*<<< orphan*/ atoi(char const *);
void *calloc(int, int);
scalar_t__ capset(TYPE_1__ *, void *);
int /*<<< orphan*/ kill(int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ memset(void *, int /*<<< orphan*/, int);
int /*<<< orphan*/ perror(char *);
scalar_t__ prctl(int /*<<< orphan*/, int);
scalar_t__ setuid(int);
int main(int argc, const char *argv[]) {
  cap_user_header_t head;
  cap_user_data_t data;
  pid_t pid;
  pid = atoi(argv[1]);
  head = calloc(1, sizeof(*head));
  head->version = _LINUX_CAPABILITY_VERSION;
  head->pid = 0;
  data = calloc(_LINUX_CAPABILITY_U32S, sizeof(*data));
  add_cap(data, CAP_KILL);
  add_cap(data, CAP_SETUID);
  if (capset(head, data) < 0) {
    perror("capset");
    return 1;
  }
  if (prctl(PR_SET_KEEPCAPS, 1) != 0) {
    perror("prctl");
    return 1;
  }
  if (setuid(1000) != 0) {
    perror("setuid");
    return 1;
  }
  memset(data, 0, _LINUX_CAPABILITY_U32S * sizeof(*data));
  add_cap(data, CAP_KILL);
  if (capset(head, data) < 0) {
    perror("capset");
    return 1;
  }
  kill(-pid, SIGKILL);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   10a0 <atoi@plt>
mov    %eax,-0x24(%rbp)
mov    $0x1,%edi
mov    $0x10,%esi
call   1060 <calloc@plt>
mov    %rax,-0x18(%rbp)
mov    0x2e10(%rip),%rax
mov    (%rax),%ecx
mov    -0x18(%rbp),%rax
mov    %ecx,0x8(%rax)
mov    -0x18(%rbp),%rax
movq   $0x0,(%rax)
mov    0x2ded(%rip),%rax
mov    (%rax),%edi
mov    $0x1,%esi
call   1060 <calloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
mov    0x2dc2(%rip),%rax
mov    (%rax),%esi
call   1030 <add_cap@plt>
mov    -0x20(%rbp),%rdi
mov    0x2db8(%rip),%rax
mov    (%rax),%esi
call   1030 <add_cap@plt>
mov    -0x18(%rbp),%rdi
mov    -0x20(%rbp),%rsi
call   1040 <capset@plt>
cmp    $0x0,%rax
jge    124e <main+0xbe>
lea    0xdc3(%rip),%rdi
call   1090 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    1325 <main+0x195>
mov    0x2d63(%rip),%rax
mov    (%rax),%edi
mov    $0x1,%esi
call   1070 <prctl@plt>
cmp    $0x0,%rax
je     1283 <main+0xf3>
lea    0xd95(%rip),%rdi
call   1090 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    1325 <main+0x195>
mov    $0x3e8,%edi
call   10b0 <setuid@plt>
cmp    $0x0,%rax
je     12af <main+0x11f>
lea    0xd6f(%rip),%rdi
call   1090 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    1325 <main+0x195>
mov    -0x20(%rbp),%rdi
mov    0x2d1e(%rip),%rax
movslq (%rax),%rax
shl    $0x0,%rax
mov    %eax,%edx
xor    %esi,%esi
call   1050 <memset@plt>
mov    -0x20(%rbp),%rdi
mov    0x2cf3(%rip),%rax
mov    (%rax),%esi
call   1030 <add_cap@plt>
mov    -0x18(%rbp),%rdi
mov    -0x20(%rbp),%rsi
call   1040 <capset@plt>
cmp    $0x0,%rax
jge    130b <main+0x17b>
lea    0xd06(%rip),%rdi
call   1090 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    1325 <main+0x195>
xor    %edi,%edi
sub    -0x24(%rbp),%edi
mov    0x2ca9(%rip),%rax
mov    (%rax),%esi
call   1080 <kill@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    0x8(%rsi),%rdi
call   10a0 <atoi@plt>
mov    %eax,%r15d
mov    $0x1,%r14d
mov    $0x1,%edi
mov    $0x10,%esi
call   1060 <calloc@plt>
mov    %rax,%rbx
mov    0x2e1a(%rip),%rax
mov    (%rax),%eax
mov    %eax,0x8(%rbx)
mov    0x2e06(%rip),%r12
mov    (%r12),%edi
mov    $0x1,%esi
call   1060 <calloc@plt>
mov    %rax,%rbp
mov    0x2dde(%rip),%r13
mov    0x0(%r13),%esi
mov    %rax,%rdi
call   1030 <add_cap@plt>
mov    0x2dd3(%rip),%rax
mov    (%rax),%esi
mov    %rbp,%rdi
call   1030 <add_cap@plt>
mov    %rbx,%rdi
mov    %rbp,%rsi
call   1040 <capset@plt>
test   %rax,%rax
js     129b <main+0x10b>
mov    0x2d96(%rip),%rax
mov    (%rax),%edi
mov    $0x1,%r14d
mov    $0x1,%esi
call   1070 <prctl@plt>
test   %rax,%rax
jne    12a9 <main+0x119>
mov    $0x3e8,%edi
call   10b0 <setuid@plt>
test   %rax,%rax
jne    12b7 <main+0x127>
mov    (%r12),%edx
mov    %rbp,%rdi
xor    %esi,%esi
call   1050 <memset@plt>
mov    0x0(%r13),%esi
mov    %rbp,%rdi
call   1030 <add_cap@plt>
mov    %rbx,%rdi
mov    %rbp,%rsi
call   1040 <capset@plt>
test   %rax,%rax
js     129b <main+0x10b>
neg    %r15d
mov    0x2d44(%rip),%rax
mov    (%rax),%esi
mov    %r15d,%edi
call   1080 <kill@plt>
xor    %r14d,%r14d
mov    %r14d,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xd5e(%rip),%rdi
call   1090 <perror@plt>
jmp    1289 <main+0xf9>
lea    0xd57(%rip),%rdi
call   1090 <perror@plt>
jmp    1289 <main+0xf9>
lea    0xd4f(%rip),%rdi
call   1090 <perror@plt>
jmp    1289 <main+0xf9>

LLVM IR (-O0):
%struct.TYPE_3__ = type { i64, i32 }
@_LINUX_CAPABILITY_VERSION = global i32 0
@_LINUX_CAPABILITY_U32S = global i32 0
@CAP_KILL = global i32 0
@CAP_SETUID = global i32 0
@.str = [7 x i8] c"capset\00"
@PR_SET_KEEPCAPS = global i32 0
@.str.1 = [6 x i8] c"prctl\00"
@.str.2 = [7 x i8] c"setuid\00"
@SIGKILL = global i32 0
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca %struct.TYPE_3__*
%7 = alloca i8*
%8 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%9 = load i8**, i8*** %5
%10 = getelementptr inbounds i8*, i8** %9, i64 1
%11 = load i8*, i8** %10
%12 = call i32 @atoi(i8* %11)
store i32 %12, i32* %8
%13 = call i8* @calloc(i32 1, i32 16)
%14 = bitcast i8* %13 to %struct.TYPE_3__*
store %struct.TYPE_3__* %14, %struct.TYPE_3__** %6
%15 = load i32, i32* @_LINUX_CAPABILITY_VERSION
%16 = load %struct.TYPE_3__*, %struct.TYPE_3__** %6
%17 = getelementptr inbounds %struct.TYPE_3__, %struct.TYPE_3__* %16, i32 0, i32 1
store i32 %15, i32* %17
%18 = load %struct.TYPE_3__*, %struct.TYPE_3__** %6
%19 = getelementptr inbounds %struct.TYPE_3__, %struct.TYPE_3__* %18, i32 0, i32 0
store i64 0, i64* %19
%20 = load i32, i32* @_LINUX_CAPABILITY_U32S
%21 = call i8* @calloc(i32 %20, i32 1)
store i8* %21, i8** %7
%22 = load i8*, i8** %7
%23 = load i32, i32* @CAP_KILL
%24 = call i32 @add_cap(i8* %22, i32 %23)
%25 = load i8*, i8** %7
%26 = load i32, i32* @CAP_SETUID
%27 = call i32 @add_cap(i8* %25, i32 %26)
%28 = load %struct.TYPE_3__*, %struct.TYPE_3__** %6
%29 = load i8*, i8** %7
%30 = call i64 @capset(%struct.TYPE_3__* %28, i8* %29)
%31 = icmp slt i64 %30, 0
br i1 %31, label %32, label %34
32: ; preds = %2
%33 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %3
br label %66
34: ; preds = %2
%35 = load i32, i32* @PR_SET_KEEPCAPS
%36 = call i64 @prctl(i32 %35, i32 1)
%37 = icmp ne i64 %36, 0
br i1 %37, label %38, label %40
38: ; preds = %34
%39 = call i32 @perror(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %3
br label %66
40: ; preds = %34
%41 = call i64 @setuid(i32 1000)
%42 = icmp ne i64 %41, 0
br i1 %42, label %43, label %45
43: ; preds = %40
%44 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
store i32 1, i32* %3
br label %66
45: ; preds = %40
%46 = load i8*, i8** %7
%47 = load i32, i32* @_LINUX_CAPABILITY_U32S
%48 = sext i32 %47 to i64
%49 = mul i64 %48, 1
%50 = trunc i64 %49 to i32
%51 = call i32 @memset(i8* %46, i32 0, i32 %50)
%52 = load i8*, i8** %7
%53 = load i32, i32* @CAP_KILL
%54 = call i32 @add_cap(i8* %52, i32 %53)
%55 = load %struct.TYPE_3__*, %struct.TYPE_3__** %6
%56 = load i8*, i8** %7
%57 = call i64 @capset(%struct.TYPE_3__* %55, i8* %56)
%58 = icmp slt i64 %57, 0
br i1 %58, label %59, label %61
59: ; preds = %45
%60 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %3
br label %66
61: ; preds = %45
%62 = load i32, i32* %8
%63 = sub nsw i32 0, %62
%64 = load i32, i32* @SIGKILL
%65 = call i32 @kill(i32 %63, i32 %64)
store i32 0, i32* %3
br label %66
66: ; preds = %61, %59, %43, %38, %32
%67 = load i32, i32* %3
ret i32 %67
}

LLVM IR (-O2):
%struct.TYPE_3__ = type { i64, i32 }
@_LINUX_CAPABILITY_VERSION = global i32 0
@_LINUX_CAPABILITY_U32S = global i32 0
@CAP_KILL = global i32 0
@CAP_SETUID = global i32 0
@.str = [7 x i8] c"capset\00"
@PR_SET_KEEPCAPS = global i32 0
@.str.1 = [6 x i8] c"prctl\00"
@.str.2 = [7 x i8] c"setuid\00"
@SIGKILL = global i32 0
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = getelementptr inbounds i8*, i8** %1, i64 1
%4 = load i8*, i8** %3
%5 = tail call i32 @atoi(i8* %4)
%6 = tail call dereferenceable_or_null(16) i8* @calloc(i32 1, i32 16)
%7 = bitcast i8* %6 to %struct.TYPE_3__*
%8 = load i32, i32* @_LINUX_CAPABILITY_VERSION
%9 = getelementptr inbounds %struct.TYPE_3__, %struct.TYPE_3__* %7, i64 0, i32 1
store i32 %8, i32* %9
%10 = load i32, i32* @_LINUX_CAPABILITY_U32S
%11 = tail call i8* @calloc(i32 %10, i32 1)
%12 = load i32, i32* @CAP_KILL
%13 = tail call i32 @add_cap(i8* %11, i32 %12)
%14 = load i32, i32* @CAP_SETUID
%15 = tail call i32 @add_cap(i8* %11, i32 %14)
%16 = tail call i64 @capset(%struct.TYPE_3__* %7, i8* %11)
%17 = icmp slt i64 %16, 0
br i1 %17, label %18, label %20
18: ; preds = %2
%19 = tail call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
br label %44
20: ; preds = %2
%21 = load i32, i32* @PR_SET_KEEPCAPS
%22 = tail call i64 @prctl(i32 %21, i32 1)
%23 = icmp eq i64 %22, 0
br i1 %23, label %26, label %24
24: ; preds = %20
%25 = tail call i32 @perror(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0))
br label %44
26: ; preds = %20
%27 = tail call i64 @setuid(i32 1000)
%28 = icmp eq i64 %27, 0
br i1 %28, label %31, label %29
29: ; preds = %26
%30 = tail call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
br label %44
31: ; preds = %26
%32 = load i32, i32* @_LINUX_CAPABILITY_U32S
%33 = tail call i32 @memset(i8* %11, i32 0, i32 %32)
%34 = load i32, i32* @CAP_KILL
%35 = tail call i32 @add_cap(i8* %11, i32 %34)
%36 = tail call i64 @capset(%struct.TYPE_3__* %7, i8* %11)
%37 = icmp slt i64 %36, 0
br i1 %37, label %38, label %40
38: ; preds = %31
%39 = tail call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
br label %44
40: ; preds = %31
%41 = sub nsw i32 0, %5
%42 = load i32, i32* @SIGKILL
%43 = tail call i32 @kill(i32 %41, i32 %42)
br label %44
44: ; preds = %40, %38, %29, %24, %18
%45 = phi i32 [ 1, %18 ], [ 1, %24 ], [ 1, %29 ], [ 1, %38 ], [ 0, %40 ]
ret i32 %45
}