#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct passwd {
  int /*<<< orphan*/ pw_uid;
  int /*<<< orphan*/ pw_gid;
};
struct group {
  int /*<<< orphan*/ gr_gid;
};

/* Variables and functions */
int /*<<< orphan*/ geteuid();
int /*<<< orphan*/ getgid();
struct group *getgrnam(char const *);
struct passwd *getpwnam(char const *);
scalar_t__ initgroups(char const *, int /*<<< orphan*/);
scalar_t__ setgid(int /*<<< orphan*/);
scalar_t__ setuid(int /*<<< orphan*/);
int drop_privileges(const char *user, const char *group) {
  if (!geteuid()) {
    struct passwd *pw;
    struct group *gr;
    if (group) {
      gr = getgrnam(group);
      if (!gr)
        return -1;
      if (setgid(gr->gr_gid))
        return -1;
    }
    pw = getpwnam(user);
    if (!pw)
      return -1;
    if (!group) {
      if (setgid(pw->pw_gid))
        return -1;
    }
    if (initgroups(user, getgid()))
      return -1;
    if (setuid(pw->pw_uid))
      return -1;
  }
  return 0;
}


x86 assembly (clang, -O0):
<drop_privileges>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    $0x0,%al
call   1030 <geteuid@plt>
cmp    $0x0,%eax
jne    1291 <drop_privileges+0x121>
cmpq   $0x0,-0x18(%rbp)
je     11e5 <drop_privileges+0x75>
mov    -0x18(%rbp),%rdi
call   1050 <getgrnam@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
jne    11bf <drop_privileges+0x4f>
movl   $0xffffffff,-0x4(%rbp)
jmp    1298 <drop_privileges+0x128>
mov    -0x28(%rbp),%rax
mov    (%rax),%edi
call   1070 <setgid@plt>
cmp    $0x0,%rax
je     11e0 <drop_privileges+0x70>
movl   $0xffffffff,-0x4(%rbp)
jmp    1298 <drop_privileges+0x128>
jmp    11e5 <drop_privileges+0x75>
mov    -0x10(%rbp),%rdi
call   1040 <getpwnam@plt>
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x20(%rbp)
jne    1209 <drop_privileges+0x99>
movl   $0xffffffff,-0x4(%rbp)
jmp    1298 <drop_privileges+0x128>
cmpq   $0x0,-0x18(%rbp)
jne    123b <drop_privileges+0xcb>
mov    -0x20(%rbp),%rax
mov    0x4(%rax),%edi
call   1070 <setgid@plt>
cmp    $0x0,%rax
je     1236 <drop_privileges+0xc6>
movl   $0xffffffff,-0x4(%rbp)
jmp    1298 <drop_privileges+0x128>
jmp    123b <drop_privileges+0xcb>
mov    -0x10(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    $0x0,%al
call   1060 <getgid@plt>
mov    -0x30(%rbp),%rdi
mov    %eax,%esi
call   1090 <initgroups@plt>
cmp    $0x0,%rax
je     126b <drop_privileges+0xfb>
movl   $0xffffffff,-0x4(%rbp)
jmp    1298 <drop_privileges+0x128>
mov    -0x20(%rbp),%rax
mov    (%rax),%edi
call   1080 <setuid@plt>
cmp    $0x0,%rax
je     128c <drop_privileges+0x11c>
movl   $0xffffffff,-0x4(%rbp)
jmp    1298 <drop_privileges+0x128>
jmp    1291 <drop_privileges+0x121>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<drop_privileges>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %rsi,%rbx
mov    %rdi,%r15
xor    %ebp,%ebp
xor    %eax,%eax
call   1030 <geteuid@plt>
test   %eax,%eax
jne    1201 <drop_privileges+0x91>
test   %rbx,%rbx
je     11ba <drop_privileges+0x4a>
mov    %rbx,%rdi
call   1050 <getgrnam@plt>
test   %rax,%rax
je     11fc <drop_privileges+0x8c>
mov    (%rax),%edi
call   1070 <setgid@plt>
test   %rax,%rax
jne    11fc <drop_privileges+0x8c>
mov    %r15,%rdi
call   1040 <getpwnam@plt>
mov    %rax,%r14
test   %rax,%rax
jne    11d7 <drop_privileges+0x67>
jmp    11fc <drop_privileges+0x8c>
mov    %r15,%rdi
call   1040 <getpwnam@plt>
test   %rax,%rax
je     11fc <drop_privileges+0x8c>
mov    %rax,%r14
mov    0x4(%rax),%edi
call   1070 <setgid@plt>
test   %rax,%rax
jne    11fc <drop_privileges+0x8c>
xor    %ebp,%ebp
xor    %eax,%eax
call   1060 <getgid@plt>
mov    %r15,%rdi
mov    %eax,%esi
call   1090 <initgroups@plt>
test   %rax,%rax
jne    11fc <drop_privileges+0x8c>
mov    (%r14),%edi
call   1080 <setuid@plt>
test   %rax,%rax
je     1201 <drop_privileges+0x91>
mov    $0xffffffff,%ebp
mov    %ebp,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.passwd = type { i32, i32 }
%struct.group = type { i32 }
define i32 @drop_privileges(i8* %0, i8* %1) {
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca %struct.passwd*
%7 = alloca %struct.group*
store i8* %0, i8** %4
store i8* %1, i8** %5
%8 = call i32 (...) @geteuid()
%9 = icmp ne i32 %8, 0
br i1 %9, label %58, label %10
10: ; preds = %2
%11 = load i8*, i8** %5
%12 = icmp ne i8* %11, null
br i1 %12, label %13, label %27
13: ; preds = %10
%14 = load i8*, i8** %5
%15 = call %struct.group* @getgrnam(i8* %14)
store %struct.group* %15, %struct.group** %7
%16 = load %struct.group*, %struct.group** %7
%17 = icmp ne %struct.group* %16, null
br i1 %17, label %19, label %18
18: ; preds = %13
store i32 -1, i32* %3
br label %59
19: ; preds = %13
%20 = load %struct.group*, %struct.group** %7
%21 = getelementptr inbounds %struct.group, %struct.group* %20, i32 0, i32 0
%22 = load i32, i32* %21
%23 = call i64 @setgid(i32 %22)
%24 = icmp ne i64 %23, 0
br i1 %24, label %25, label %26
25: ; preds = %19
store i32 -1, i32* %3
br label %59
26: ; preds = %19
br label %27
27: ; preds = %26, %10
%28 = load i8*, i8** %4
%29 = call %struct.passwd* @getpwnam(i8* %28)
store %struct.passwd* %29, %struct.passwd** %6
%30 = load %struct.passwd*, %struct.passwd** %6
%31 = icmp ne %struct.passwd* %30, null
br i1 %31, label %33, label %32
32: ; preds = %27
store i32 -1, i32* %3
br label %59
33: ; preds = %27
%34 = load i8*, i8** %5
%35 = icmp ne i8* %34, null
br i1 %35, label %44, label %36
36: ; preds = %33
%37 = load %struct.passwd*, %struct.passwd** %6
%38 = getelementptr inbounds %struct.passwd, %struct.passwd* %37, i32 0, i32 1
%39 = load i32, i32* %38
%40 = call i64 @setgid(i32 %39)
%41 = icmp ne i64 %40, 0
br i1 %41, label %42, label %43
42: ; preds = %36
store i32 -1, i32* %3
br label %59
43: ; preds = %36
br label %44
44: ; preds = %43, %33
%45 = load i8*, i8** %4
%46 = call i32 (...) @getgid()
%47 = call i64 @initgroups(i8* %45, i32 %46)
%48 = icmp ne i64 %47, 0
br i1 %48, label %49, label %50
49: ; preds = %44
store i32 -1, i32* %3
br label %59
50: ; preds = %44
%51 = load %struct.passwd*, %struct.passwd** %6
%52 = getelementptr inbounds %struct.passwd, %struct.passwd* %51, i32 0, i32 0
%53 = load i32, i32* %52
%54 = call i64 @setuid(i32 %53)
%55 = icmp ne i64 %54, 0
br i1 %55, label %56, label %57
56: ; preds = %50
store i32 -1, i32* %3
br label %59
57: ; preds = %50
br label %58
58: ; preds = %57, %2
store i32 0, i32* %3
br label %59
59: ; preds = %58, %56, %49, %42, %32, %25, %18
%60 = load i32, i32* %3
ret i32 %60
}

LLVM IR (-O2):
%struct.group = type { i32 }
%struct.passwd = type { i32, i32 }
define i32 @drop_privileges(i8* %0, i8* %1) {
%3 = tail call i32 (...) @geteuid()
%4 = icmp eq i32 %3, 0
br i1 %4, label %5, label %37
5: ; preds = %2
%6 = icmp eq i8* %1, null
br i1 %6, label %15, label %7
7: ; preds = %5
%8 = tail call %struct.group* @getgrnam(i8* %1)
%9 = icmp eq %struct.group* %8, null
br i1 %9, label %36, label %10
10: ; preds = %7
%11 = getelementptr inbounds %struct.group, %struct.group* %8, i64 0, i32 0
%12 = load i32, i32* %11
%13 = tail call i64 @setgid(i32 %12)
%14 = icmp eq i64 %13, 0
br i1 %14, label %18, label %36
15: ; preds = %5
%16 = tail call %struct.passwd* @getpwnam(i8* %0)
%17 = icmp eq %struct.passwd* %16, null
br i1 %17, label %36, label %21
18: ; preds = %10
%19 = tail call %struct.passwd* @getpwnam(i8* %0)
%20 = icmp eq %struct.passwd* %19, null
br i1 %20, label %36, label %26
21: ; preds = %15
%22 = getelementptr inbounds %struct.passwd, %struct.passwd* %16, i64 0, i32 1
%23 = load i32, i32* %22
%24 = tail call i64 @setgid(i32 %23)
%25 = icmp eq i64 %24, 0
br i1 %25, label %26, label %36
26: ; preds = %18, %21
%27 = phi %struct.passwd* [ %16, %21 ], [ %19, %18 ]
%28 = tail call i32 (...) @getgid()
%29 = tail call i64 @initgroups(i8* %0, i32 %28)
%30 = icmp eq i64 %29, 0
br i1 %30, label %31, label %36
31: ; preds = %26
%32 = getelementptr inbounds %struct.passwd, %struct.passwd* %27, i64 0, i32 0
%33 = load i32, i32* %32
%34 = tail call i64 @setuid(i32 %33)
%35 = icmp eq i64 %34, 0
br i1 %35, label %37, label %36
36: ; preds = %7, %10, %15, %21, %26, %31, %18
br label %37
37: ; preds = %2, %31, %36
%38 = phi i32 [ -1, %36 ], [ 0, %31 ], [ 0, %2 ]
ret i32 %38
}