#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ tmp;
struct stat {
  int st_mode;
};

/* Variables and functions */
int /*<<< orphan*/ O_RDWR;
int S_IFMT;
int /*<<< orphan*/ W_OK;
scalar_t__ access(char *, int /*<<< orphan*/);
int /*<<< orphan*/ errno;
int /*<<< orphan*/ execvp(char *, char **);
int /*<<< orphan*/ fflush(int /*<<< orphan*/);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *, ...);
scalar_t__ geteuid();
int getgid();
int getuid();
int mount(char *, char *, char *, int /*<<< orphan*/, char *);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
scalar_t__ seteuid(int /*<<< orphan*/);
scalar_t__ setgid(int);
scalar_t__ setuid(int);
int /*<<< orphan*/ snprintf(char *, int, char *, int, ...);
int stat(char *, struct stat *);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ stdout;
char *strerror(int /*<<< orphan*/);
int main(int argc, char **argv) {
  char *mnt;
  char tmp[128];
  struct stat stbuf;
  int fd;
  int res;
  int i;
  printf("UID %d %d\n", geteuid(), getuid());
  if (geteuid() != 0 || getuid() == 0) {
    fprintf(stderr, "Not running as setuid root\n", argv[0]);
    return 1;
  }
  mnt = argv[argc - 1];
  if (access(mnt, W_OK) != 0) {
    fprintf(stderr, "%s: no write access mountpoint %s: %s\n", argv[0], mnt,
            strerror(errno));
    return 1;
  }
  res = stat(mnt, &stbuf);
  if (res == -1) {
    fprintf(stderr, "%s: failed to access mountpoint %s: %s\n", argv[0], mnt,
            strerror(errno));
    return 1;
  }
  fd = open("/dev/fuse", O_RDWR);
  if (fd == -1) {
    fprintf(stderr, "%s: failed to open /dev/fuse: %s\n", argv[0],
            strerror(errno));
    return 1;
  }
  snprintf(tmp, sizeof(tmp), "fd=%i,rootmode=%o,user_id=%u,group_id=%u", fd,
           stbuf.st_mode & S_IFMT, getuid(), getgid());
  res = mount("/dev/fuse", mnt, "fuse", 0, tmp);
  if (res == -1) {
    fprintf(stderr, "%s: failed to mount -o %s /dev/fuse %s: %s\n", argv[0],
            tmp, mnt, strerror(errno));
    return 1;
  }
  if (setgid(getgid()) != 0) {
    fprintf(stderr, "%s: failed to drop gid privilege: %s\n", argv[0],
            strerror(errno));
    return 1;
  }
  if (setuid(getuid()) != 0) {
    fprintf(stderr, "%s: failed to drop gid privilege: %s\n", argv[0],
            strerror(errno));
    return 1;
  }
  if (setuid(0) == 0 || seteuid(0) == 0) {
    fprintf(stderr, "%s: did not successfully drop root privilege\n", argv[0]);
    return 1;
  }
  snprintf(tmp, sizeof(tmp), "/dev/fd/%d", fd);
  argv[argc - 1] = tmp;
  printf("+ ");
  for (i = 1; i < argc; i++)
    printf("%s ", argv[i]);
  printf("\n");
  fflush(stdout);
  execvp(argv[1], &argv[1]);
  perror("failed to execvp");
  return (1);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x160,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    $0x0,%al
call   1070 <geteuid@plt>
mov    %rax,-0xc0(%rbp)
mov    $0x0,%al
call   1040 <getuid@plt>
mov    -0xc0(%rbp),%rsi
mov    %eax,%edx
lea    0xdb2(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x0,%al
call   1070 <geteuid@plt>
cmp    $0x0,%rax
jne    1276 <main+0x66>
mov    $0x0,%al
call   1040 <getuid@plt>
cmp    $0x0,%eax
jne    12a0 <main+0x90>
mov    0x2d4b(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xd7e(%rip),%rsi
mov    $0x0,%al
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    175c <main+0x54c>
mov    -0x10(%rbp),%rax
mov    -0x8(%rbp),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
mov    (%rax,%rcx,8),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
mov    0x2d20(%rip),%rax
mov    (%rax),%esi
call   10e0 <access@plt>
cmp    $0x0,%rax
je     1338 <main+0x128>
mov    0x2cf0(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0xd4(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0xd0(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0xc8(%rbp)
mov    0x2cc0(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    -0xd4(%rbp),%edi
mov    -0xd0(%rbp),%rdx
mov    -0xc8(%rbp),%rcx
mov    %rax,%r8
lea    0xd02(%rip),%rsi
mov    $0x0,%al
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    175c <main+0x54c>
mov    -0x18(%rbp),%rdi
lea    -0xa8(%rbp),%rsi
call   1090 <stat@plt>
mov    %eax,-0xb0(%rbp)
cmpl   $0xffffffff,-0xb0(%rbp)
jne    13c2 <main+0x1b2>
mov    0x2c66(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0xec(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0xe8(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0xe0(%rbp)
mov    0x2c36(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    -0xec(%rbp),%edi
mov    -0xe8(%rbp),%rdx
mov    -0xe0(%rbp),%rcx
mov    %rax,%r8
lea    0xc9f(%rip),%rsi
mov    $0x0,%al
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    175c <main+0x54c>
mov    0x2c1f(%rip),%rax
mov    (%rax),%esi
lea    0xca4(%rip),%rdi
call   10d0 <open@plt>
mov    %eax,-0xac(%rbp)
cmpl   $0xffffffff,-0xac(%rbp)
jne    143f <main+0x22f>
mov    0x2bd7(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0xfc(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0xf8(%rbp)
mov    0x2bb2(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    -0xfc(%rbp),%edi
mov    -0xf8(%rbp),%rdx
mov    %rax,%rcx
lea    0xc54(%rip),%rsi
mov    $0x0,%al
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    175c <main+0x54c>
lea    -0xa0(%rbp),%rax
mov    %rax,-0x110(%rbp)
mov    -0xac(%rbp),%eax
mov    %eax,-0x108(%rbp)
mov    -0xa8(%rbp),%eax
mov    0x2b6a(%rip),%rcx
and    (%rcx),%eax
mov    %eax,-0x104(%rbp)
mov    $0x0,%al
call   1040 <getuid@plt>
mov    %eax,-0x100(%rbp)
mov    $0x0,%al
call   10a0 <getgid@plt>
mov    -0x110(%rbp),%rdi
mov    -0x108(%rbp),%ecx
mov    -0x104(%rbp),%r8d
mov    -0x100(%rbp),%r9d
mov    $0x80,%esi
lea    0xbf9(%rip),%rdx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1060 <snprintf@plt>
mov    -0x18(%rbp),%rsi
lea    -0xa0(%rbp),%r8
lea    0xbb1(%rip),%rdi
lea    0xbaf(%rip),%rdx
xor    %ecx,%ecx
call   1030 <mount@plt>
mov    %eax,-0xb0(%rbp)
cmpl   $0xffffffff,-0xb0(%rbp)
jne    1562 <main+0x352>
mov    0x2adb(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x12c(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x128(%rbp)
lea    -0xa0(%rbp),%rax
mov    %rax,-0x120(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x118(%rbp)
mov    0x2a9d(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    -0x12c(%rbp),%edi
mov    -0x128(%rbp),%rdx
mov    -0x120(%rbp),%rcx
mov    -0x118(%rbp),%r8
mov    %rax,%r9
lea    0xb7c(%rip),%rsi
mov    $0x0,%al
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    175c <main+0x54c>
mov    $0x0,%al
call   10a0 <getgid@plt>
mov    %eax,%edi
call   10c0 <setgid@plt>
cmp    $0x0,%rax
je     15cf <main+0x3bf>
mov    0x2a47(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x13c(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x138(%rbp)
mov    0x2a22(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    -0x13c(%rbp),%edi
mov    -0x138(%rbp),%rdx
mov    %rax,%rcx
lea    0xb3b(%rip),%rsi
mov    $0x0,%al
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    175c <main+0x54c>
mov    $0x0,%al
call   1040 <getuid@plt>
mov    %eax,%edi
call   1110 <setuid@plt>
cmp    $0x0,%rax
je     163c <main+0x42c>
mov    0x29da(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x14c(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x148(%rbp)
mov    0x29b5(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    -0x14c(%rbp),%edi
mov    -0x148(%rbp),%rdx
mov    %rax,%rcx
lea    0xace(%rip),%rsi
mov    $0x0,%al
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    175c <main+0x54c>
xor    %edi,%edi
call   1110 <setuid@plt>
cmp    $0x0,%rax
je     165e <main+0x44e>
xor    %edi,%edi
call   1130 <seteuid@plt>
cmp    $0x0,%rax
jne    1688 <main+0x478>
mov    0x2963(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xaa8(%rip),%rsi
mov    $0x0,%al
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    175c <main+0x54c>
lea    -0xa0(%rbp),%rdi
mov    -0xac(%rbp),%ecx
mov    $0x80,%esi
lea    0xaaa(%rip),%rdx
mov    $0x0,%al
call   1060 <snprintf@plt>
lea    -0xa0(%rbp),%rdx
mov    -0x10(%rbp),%rax
mov    -0x8(%rbp),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
lea    0xa8f(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0x1,-0xb4(%rbp)
mov    -0xb4(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    1718 <main+0x508>
mov    -0x10(%rbp),%rax
movslq -0xb4(%rbp),%rcx
mov    (%rax,%rcx,8),%rsi
lea    0xa5c(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0xb4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xb4(%rbp)
jmp    16d8 <main+0x4c8>
lea    0x8ea(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    0x288b(%rip),%rax
mov    (%rax),%edi
call   10b0 <fflush@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
mov    -0x10(%rbp),%rsi
add    $0x8,%rsi
call   1100 <execvp@plt>
lea    0xa0d(%rip),%rdi
call   10f0 <perror@plt>
movl   $0x1,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x160,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0xa8,%rsp
mov    %rsi,%rbx
mov    %edi,%r13d
xor    %eax,%eax
call   1080 <geteuid@plt>
mov    %rax,%rbp
xor    %eax,%eax
call   1050 <getuid@plt>
lea    0xdb1(%rip),%rdi
mov    %rbp,%rsi
mov    %eax,%edx
xor    %eax,%eax
call   1060 <printf@plt>
xor    %eax,%eax
call   1080 <geteuid@plt>
test   %rax,%rax
je     1298 <main+0x78>
mov    0x2d5a(%rip),%rax
mov    (%rax),%edi
mov    (%rbx),%rdx
lea    0xd91(%rip),%rsi
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x1,%eax
add    $0xa8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
xor    %eax,%eax
call   1050 <getuid@plt>
test   %eax,%eax
je     1267 <main+0x47>
movslq %r13d,%r15
mov    -0x8(%rbx,%r15,8),%r14
mov    0x2d2e(%rip),%rax
mov    (%rax),%esi
mov    %r14,%rdi
call   10f0 <access@plt>
test   %rax,%rax
je     12f6 <main+0xd6>
mov    0x2d00(%rip),%rax
mov    (%rax),%ebp
mov    (%rbx),%rbx
mov    0x2cec(%rip),%rax
mov    (%rax),%edi
call   1130 <strerror@plt>
lea    0xd45(%rip),%rsi
mov    %ebp,%edi
mov    %rbx,%rdx
mov    %r14,%rcx
mov    %rax,%r8
xor    %eax,%eax
call   1090 <fprintf@plt>
jmp    1281 <main+0x61>
lea    0x10(%rsp),%rsi
mov    %r14,%rdi
call   10a0 <stat@plt>
cmp    $0xffffffff,%eax
je     13eb <main+0x1cb>
mov    0x2cd5(%rip),%rax
mov    (%rax),%esi
lea    0xd5a(%rip),%rdi
call   10e0 <open@plt>
cmp    $0xffffffff,%eax
je     1411 <main+0x1f1>
mov    %eax,%r12d
mov    0x2c9c(%rip),%rax
mov    (%rax),%ebp
and    0x10(%rsp),%ebp
xor    %eax,%eax
call   1050 <getuid@plt>
mov    %eax,0x1c(%rsp)
xor    %eax,%eax
call   10b0 <getgid@plt>
mov    %eax,(%rsp)
lea    0xd4c(%rip),%rdx
lea    0x20(%rsp),%rdi
mov    $0x80,%esi
mov    %r12d,0x18(%rsp)
mov    %r12d,%ecx
mov    %rdi,%r12
mov    %ebp,%r8d
mov    0x1c(%rsp),%r9d
xor    %eax,%eax
call   1070 <snprintf@plt>
lea    0xcf5(%rip),%rdi
lea    0xcf3(%rip),%rdx
mov    %r14,%rsi
xor    %ecx,%ecx
mov    %r12,%r8
call   1040 <mount@plt>
cmp    $0xffffffff,%eax
je     1446 <main+0x226>
xor    %eax,%eax
call   10b0 <getgid@plt>
mov    %eax,%edi
call   10d0 <setgid@plt>
test   %rax,%rax
jne    13c8 <main+0x1a8>
xor    %eax,%eax
call   1050 <getuid@plt>
mov    %eax,%edi
call   1120 <setuid@plt>
test   %rax,%rax
je     1483 <main+0x263>
mov    0x2bf9(%rip),%rax
mov    (%rax),%ebp
mov    (%rbx),%rbx
mov    0x2be5(%rip),%rax
mov    (%rax),%edi
call   1130 <strerror@plt>
lea    0xd0e(%rip),%rsi
jmp    1432 <main+0x212>
mov    0x2bd6(%rip),%rax
mov    (%rax),%ebp
mov    (%rbx),%rbx
mov    0x2bc2(%rip),%rax
mov    (%rax),%edi
call   1130 <strerror@plt>
lea    0xc42(%rip),%rsi
jmp    12e2 <main+0xc2>
mov    0x2bb0(%rip),%rax
mov    (%rax),%ebp
mov    (%rbx),%rbx
mov    0x2b9c(%rip),%rax
mov    (%rax),%edi
call   1130 <strerror@plt>
lea    0xc4e(%rip),%rsi
mov    %ebp,%edi
mov    %rbx,%rdx
mov    %rax,%rcx
xor    %eax,%eax
call   1090 <fprintf@plt>
jmp    1281 <main+0x61>
mov    0x2b7b(%rip),%rax
mov    (%rax),%ebp
mov    (%rbx),%rbx
mov    0x2b67(%rip),%rax
mov    (%rax),%edi
call   1130 <strerror@plt>
lea    0xc64(%rip),%rsi
lea    0x20(%rsp),%rcx
mov    %ebp,%edi
mov    %rbx,%rdx
mov    %r14,%r8
mov    %rax,%r9
xor    %eax,%eax
call   1090 <fprintf@plt>
jmp    1281 <main+0x61>
xor    %edi,%edi
call   1120 <setuid@plt>
test   %rax,%rax
je     149b <main+0x27b>
xor    %edi,%edi
call   1140 <seteuid@plt>
test   %rax,%rax
jne    14b3 <main+0x293>
mov    0x2b26(%rip),%rax
mov    (%rax),%edi
mov    (%rbx),%rdx
lea    0xc6f(%rip),%rsi
jmp    127a <main+0x5a>
lea    -0x1(%r15),%rbp
lea    0xc8d(%rip),%rdx
mov    %r12,%rdi
mov    $0x80,%esi
mov    0x18(%rsp),%ecx
xor    %eax,%eax
call   1070 <snprintf@plt>
mov    %r12,(%rbx,%rbp,8)
lea    0xc7a(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
cmp    $0x2,%r15d
jl     150f <main+0x2ef>
mov    %r13d,%r15d
mov    $0x1,%ebp
lea    0xc61(%rip),%r14
mov    (%rbx,%rbp,8),%rsi
mov    %r14,%rdi
xor    %eax,%eax
call   1060 <printf@plt>
add    $0x1,%rbp
cmp    %rbp,%r15
jne    14f8 <main+0x2d8>
mov    $0xa,%edi
call   1030 <putchar@plt>
mov    0x2a98(%rip),%rax
mov    (%rax),%edi
call   10c0 <fflush@plt>
mov    0x8(%rbx),%rdi
add    $0x8,%rbx
mov    %rbx,%rsi
call   1110 <execvp@plt>
lea    0xc1f(%rip),%rdi
call   1100 <perror@plt>
jmp    1281 <main+0x61>

LLVM IR (-O0):
%struct.stat = type { i32 }
@.str = [11 x i8] c"UID %d %d\0A\00"
@stderr = global i32 0
@.str.1 = [28 x i8] c"Not running as setuid root\0A\00"
@W_OK = global i32 0
@.str.2 = [39 x i8] c"%s: no write access mountpoint %s: %s\0A\00"
@errno = global i32 0
@.str.3 = [40 x i8] c"%s: failed to access mountpoint %s: %s\0A\00"
@.str.4 = [10 x i8] c"/dev/fuse\00"
@O_RDWR = global i32 0
@.str.5 = [34 x i8] c"%s: failed to open /dev/fuse: %s\0A\00"
@.str.6 = [41 x i8] c"fd=%i,rootmode=%o,user_id=%u,group_id=%u\00"
@S_IFMT = global i32 0
@.str.7 = [5 x i8] c"fuse\00"
@.str.8 = [44 x i8] c"%s: failed to mount -o %s /dev/fuse %s: %s\0A\00"
@.str.9 = [38 x i8] c"%s: failed to drop gid privilege: %s\0A\00"
@.str.10 = [46 x i8] c"%s: did not successfully drop root privilege\0A\00"
@.str.11 = [11 x i8] c"/dev/fd/%d\00"
@.str.12 = [3 x i8] c"+ \00"
@.str.13 = [4 x i8] c"%s \00"
@.str.14 = [2 x i8] c"\0A\00"
@stdout = global i32 0
@.str.15 = [17 x i8] c"failed to execvp\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca [128 x i8]
%8 = alloca %struct.stat
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%12 = call i64 (...) @geteuid()
%13 = call i32 (...) @getuid()
%14 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0), i64 %12, i32 %13)
%15 = call i64 (...) @geteuid()
%16 = icmp ne i64 %15, 0
br i1 %16, label %20, label %17
17: ; preds = %2
%18 = call i32 (...) @getuid()
%19 = icmp eq i32 %18, 0
br i1 %19, label %20, label %26
20: ; preds = %17, %2
%21 = load i32, i32* @stderr
%22 = load i8**, i8*** %5
%23 = getelementptr inbounds i8*, i8** %22, i64 0
%24 = load i8*, i8** %23
%25 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %21, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.1, i64 0, i64 0), i8* %24)
store i32 1, i32* %3
br label %170
26: ; preds = %17
%27 = load i8**, i8*** %5
%28 = load i32, i32* %4
%29 = sub nsw i32 %28, 1
%30 = sext i32 %29 to i64
%31 = getelementptr inbounds i8*, i8** %27, i64 %30
%32 = load i8*, i8** %31
store i8* %32, i8** %6
%33 = load i8*, i8** %6
%34 = load i32, i32* @W_OK
%35 = call i64 @access(i8* %33, i32 %34)
%36 = icmp ne i64 %35, 0
br i1 %36, label %37, label %46
37: ; preds = %26
%38 = load i32, i32* @stderr
%39 = load i8**, i8*** %5
%40 = getelementptr inbounds i8*, i8** %39, i64 0
%41 = load i8*, i8** %40
%42 = load i8*, i8** %6
%43 = load i32, i32* @errno
%44 = call i8* @strerror(i32 %43)
%45 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %38, i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.2, i64 0, i64 0), i8* %41, i8* %42, i8* %44)
store i32 1, i32* %3
br label %170
46: ; preds = %26
%47 = load i8*, i8** %6
%48 = call i32 @stat(i8* %47, %struct.stat* %8)
store i32 %48, i32* %10
%49 = load i32, i32* %10
%50 = icmp eq i32 %49, -1
br i1 %50, label %51, label %60
51: ; preds = %46
%52 = load i32, i32* @stderr
%53 = load i8**, i8*** %5
%54 = getelementptr inbounds i8*, i8** %53, i64 0
%55 = load i8*, i8** %54
%56 = load i8*, i8** %6
%57 = load i32, i32* @errno
%58 = call i8* @strerror(i32 %57)
%59 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %52, i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.3, i64 0, i64 0), i8* %55, i8* %56, i8* %58)
store i32 1, i32* %3
br label %170
60: ; preds = %46
%61 = load i32, i32* @O_RDWR
%62 = call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0), i32 %61)
store i32 %62, i32* %9
%63 = load i32, i32* %9
%64 = icmp eq i32 %63, -1
br i1 %64, label %65, label %73
65: ; preds = %60
%66 = load i32, i32* @stderr
%67 = load i8**, i8*** %5
%68 = getelementptr inbounds i8*, i8** %67, i64 0
%69 = load i8*, i8** %68
%70 = load i32, i32* @errno
%71 = call i8* @strerror(i32 %70)
%72 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %66, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.5, i64 0, i64 0), i8* %69, i8* %71)
store i32 1, i32* %3
br label %170
73: ; preds = %60
%74 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%75 = load i32, i32* %9
%76 = getelementptr inbounds %struct.stat, %struct.stat* %8, i32 0, i32 0
%77 = load i32, i32* %76
%78 = load i32, i32* @S_IFMT
%79 = and i32 %77, %78
%80 = call i32 (...) @getuid()
%81 = call i32 (...) @getgid()
%82 = call i32 (i8*, i32, i8*, i32, ...) @snprintf(i8* %74, i32 128, i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.6, i64 0, i64 0), i32 %75, i32 %79, i32 %80, i32 %81)
%83 = load i8*, i8** %6
%84 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%85 = call i32 @mount(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0), i8* %83, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.7, i64 0, i64 0), i32 0, i8* %84)
store i32 %85, i32* %10
%86 = load i32, i32* %10
%87 = icmp eq i32 %86, -1
br i1 %87, label %88, label %98
88: ; preds = %73
%89 = load i32, i32* @stderr
%90 = load i8**, i8*** %5
%91 = getelementptr inbounds i8*, i8** %90, i64 0
%92 = load i8*, i8** %91
%93 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%94 = load i8*, i8** %6
%95 = load i32, i32* @errno
%96 = call i8* @strerror(i32 %95)
%97 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %89, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.8, i64 0, i64 0), i8* %92, i8* %93, i8* %94, i8* %96)
store i32 1, i32* %3
br label %170
98: ; preds = %73
%99 = call i32 (...) @getgid()
%100 = call i64 @setgid(i32 %99)
%101 = icmp ne i64 %100, 0
br i1 %101, label %102, label %110
102: ; preds = %98
%103 = load i32, i32* @stderr
%104 = load i8**, i8*** %5
%105 = getelementptr inbounds i8*, i8** %104, i64 0
%106 = load i8*, i8** %105
%107 = load i32, i32* @errno
%108 = call i8* @strerror(i32 %107)
%109 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %103, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.9, i64 0, i64 0), i8* %106, i8* %108)
store i32 1, i32* %3
br label %170
110: ; preds = %98
%111 = call i32 (...) @getuid()
%112 = call i64 @setuid(i32 %111)
%113 = icmp ne i64 %112, 0
br i1 %113, label %114, label %122
114: ; preds = %110
%115 = load i32, i32* @stderr
%116 = load i8**, i8*** %5
%117 = getelementptr inbounds i8*, i8** %116, i64 0
%118 = load i8*, i8** %117
%119 = load i32, i32* @errno
%120 = call i8* @strerror(i32 %119)
%121 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %115, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.9, i64 0, i64 0), i8* %118, i8* %120)
store i32 1, i32* %3
br label %170
122: ; preds = %110
%123 = call i64 @setuid(i32 0)
%124 = icmp eq i64 %123, 0
br i1 %124, label %128, label %125
125: ; preds = %122
%126 = call i64 @seteuid(i32 0)
%127 = icmp eq i64 %126, 0
br i1 %127, label %128, label %134
128: ; preds = %125, %122
%129 = load i32, i32* @stderr
%130 = load i8**, i8*** %5
%131 = getelementptr inbounds i8*, i8** %130, i64 0
%132 = load i8*, i8** %131
%133 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %129, i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.10, i64 0, i64 0), i8* %132)
store i32 1, i32* %3
br label %170
134: ; preds = %125
%135 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%136 = load i32, i32* %9
%137 = call i32 (i8*, i32, i8*, i32, ...) @snprintf(i8* %135, i32 128, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.11, i64 0, i64 0), i32 %136)
%138 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%139 = load i8**, i8*** %5
%140 = load i32, i32* %4
%141 = sub nsw i32 %140, 1
%142 = sext i32 %141 to i64
%143 = getelementptr inbounds i8*, i8** %139, i64 %142
store i8* %138, i8** %143
%144 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.12, i64 0, i64 0))
store i32 1, i32* %11
br label %145
145: ; preds = %156, %134
%146 = load i32, i32* %11
%147 = load i32, i32* %4
%148 = icmp slt i32 %146, %147
br i1 %148, label %149, label %159
149: ; preds = %145
%150 = load i8**, i8*** %5
%151 = load i32, i32* %11
%152 = sext i32 %151 to i64
%153 = getelementptr inbounds i8*, i8** %150, i64 %152
%154 = load i8*, i8** %153
%155 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.13, i64 0, i64 0), i8* %154)
br label %156
156: ; preds = %149
%157 = load i32, i32* %11
%158 = add nsw i32 %157, 1
store i32 %158, i32* %11
br label %145
159: ; preds = %145
%160 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.14, i64 0, i64 0))
%161 = load i32, i32* @stdout
%162 = call i32 @fflush(i32 %161)
%163 = load i8**, i8*** %5
%164 = getelementptr inbounds i8*, i8** %163, i64 1
%165 = load i8*, i8** %164
%166 = load i8**, i8*** %5
%167 = getelementptr inbounds i8*, i8** %166, i64 1
%168 = call i32 @execvp(i8* %165, i8** %167)
%169 = call i32 @perror(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.15, i64 0, i64 0))
store i32 1, i32* %3
br label %170
170: ; preds = %159, %128, %114, %102, %88, %65, %51, %37, %20
%171 = load i32, i32* %3
ret i32 %171
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@.str = [11 x i8] c"UID %d %d\0A\00"
@stderr = global i32 0
@.str.1 = [28 x i8] c"Not running as setuid root\0A\00"
@W_OK = global i32 0
@.str.2 = [39 x i8] c"%s: no write access mountpoint %s: %s\0A\00"
@errno = global i32 0
@.str.3 = [40 x i8] c"%s: failed to access mountpoint %s: %s\0A\00"
@.str.4 = [10 x i8] c"/dev/fuse\00"
@O_RDWR = global i32 0
@.str.5 = [34 x i8] c"%s: failed to open /dev/fuse: %s\0A\00"
@.str.6 = [41 x i8] c"fd=%i,rootmode=%o,user_id=%u,group_id=%u\00"
@S_IFMT = global i32 0
@.str.7 = [5 x i8] c"fuse\00"
@.str.8 = [44 x i8] c"%s: failed to mount -o %s /dev/fuse %s: %s\0A\00"
@.str.9 = [38 x i8] c"%s: failed to drop gid privilege: %s\0A\00"
@.str.10 = [46 x i8] c"%s: did not successfully drop root privilege\0A\00"
@.str.11 = [11 x i8] c"/dev/fd/%d\00"
@.str.12 = [3 x i8] c"+ \00"
@.str.13 = [4 x i8] c"%s \00"
@stdout = global i32 0
@.str.15 = [17 x i8] c"failed to execvp\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca [128 x i8]
%4 = alloca %struct.stat
%5 = getelementptr inbounds [128 x i8], [128 x i8]* %3, i64 0, i64 0
%6 = bitcast %struct.stat* %4 to i8*
%7 = tail call i64 (...) @geteuid()
%8 = tail call i32 (...) @getuid()
%9 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0), i64 %7, i32 %8)
%10 = tail call i64 (...) @geteuid()
%11 = icmp eq i64 %10, 0
br i1 %11, label %12, label %15
12: ; preds = %2
%13 = tail call i32 (...) @getuid()
%14 = icmp eq i32 %13, 0
br i1 %14, label %15, label %19
15: ; preds = %12, %2
%16 = load i32, i32* @stderr
%17 = load i8*, i8** %1
%18 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %16, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.1, i64 0, i64 0), i8* %17)
br label %119
19: ; preds = %12
%20 = add nsw i32 %0, -1
%21 = sext i32 %20 to i64
%22 = getelementptr inbounds i8*, i8** %1, i64 %21
%23 = load i8*, i8** %22
%24 = load i32, i32* @W_OK
%25 = tail call i64 @access(i8* %23, i32 %24)
%26 = icmp eq i64 %25, 0
br i1 %26, label %33, label %27
27: ; preds = %19
%28 = load i32, i32* @stderr
%29 = load i8*, i8** %1
%30 = load i32, i32* @errno
%31 = tail call i8* @strerror(i32 %30)
%32 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %28, i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.2, i64 0, i64 0), i8* %29, i8* %23, i8* %31)
br label %119
33: ; preds = %19
%34 = call i32 @stat(i8* %23, %struct.stat* %4)
%35 = icmp eq i32 %34, -1
br i1 %35, label %36, label %42
36: ; preds = %33
%37 = load i32, i32* @stderr
%38 = load i8*, i8** %1
%39 = load i32, i32* @errno
%40 = tail call i8* @strerror(i32 %39)
%41 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %37, i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.3, i64 0, i64 0), i8* %38, i8* %23, i8* %40)
br label %119
42: ; preds = %33
%43 = load i32, i32* @O_RDWR
%44 = tail call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0), i32 %43)
%45 = icmp eq i32 %44, -1
br i1 %45, label %46, label %52
46: ; preds = %42
%47 = load i32, i32* @stderr
%48 = load i8*, i8** %1
%49 = load i32, i32* @errno
%50 = tail call i8* @strerror(i32 %49)
%51 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %47, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.5, i64 0, i64 0), i8* %48, i8* %50)
br label %119
52: ; preds = %42
%53 = getelementptr inbounds %struct.stat, %struct.stat* %4, i64 0, i32 0
%54 = load i32, i32* %53
%55 = load i32, i32* @S_IFMT
%56 = and i32 %55, %54
%57 = tail call i32 (...) @getuid()
%58 = tail call i32 (...) @getgid()
%59 = call i32 (i8*, i32, i8*, i32, ...) @snprintf(i8* %5, i32 128, i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.6, i64 0, i64 0), i32 %44, i32 %56, i32 %57, i32 %58)
%60 = call i32 @mount(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0), i8* %23, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.7, i64 0, i64 0), i32 0, i8* %5)
%61 = icmp eq i32 %60, -1
br i1 %61, label %62, label %68
62: ; preds = %52
%63 = load i32, i32* @stderr
%64 = load i8*, i8** %1
%65 = load i32, i32* @errno
%66 = call i8* @strerror(i32 %65)
%67 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %63, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.8, i64 0, i64 0), i8* %64, i8* %5, i8* %23, i8* %66)
br label %119
68: ; preds = %52
%69 = call i32 (...) @getgid()
%70 = call i64 @setgid(i32 %69)
%71 = icmp eq i64 %70, 0
br i1 %71, label %78, label %72
72: ; preds = %68
%73 = load i32, i32* @stderr
%74 = load i8*, i8** %1
%75 = load i32, i32* @errno
%76 = call i8* @strerror(i32 %75)
%77 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %73, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.9, i64 0, i64 0), i8* %74, i8* %76)
br label %119
78: ; preds = %68
%79 = call i32 (...) @getuid()
%80 = call i64 @setuid(i32 %79)
%81 = icmp eq i64 %80, 0
br i1 %81, label %88, label %82
82: ; preds = %78
%83 = load i32, i32* @stderr
%84 = load i8*, i8** %1
%85 = load i32, i32* @errno
%86 = call i8* @strerror(i32 %85)
%87 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %83, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.9, i64 0, i64 0), i8* %84, i8* %86)
br label %119
88: ; preds = %78
%89 = call i64 @setuid(i32 0)
%90 = icmp eq i64 %89, 0
br i1 %90, label %94, label %91
91: ; preds = %88
%92 = call i64 @seteuid(i32 0)
%93 = icmp eq i64 %92, 0
br i1 %93, label %94, label %98
94: ; preds = %91, %88
%95 = load i32, i32* @stderr
%96 = load i8*, i8** %1
%97 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %95, i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.10, i64 0, i64 0), i8* %96)
br label %119
98: ; preds = %91
%99 = call i32 (i8*, i32, i8*, i32, ...) @snprintf(i8* %5, i32 128, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.11, i64 0, i64 0), i32 %44)
store i8* %5, i8** %22
%100 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([3 x i8], [3 x i8]* @.str.12, i64 0, i64 0))
%101 = icmp sgt i32 %0, 1
br i1 %101, label %102, label %111
102: ; preds = %98
%103 = zext i32 %0 to i64
br label %104
104: ; preds = %102, %104
%105 = phi i64 [ 1, %102 ], [ %109, %104 ]
%106 = getelementptr inbounds i8*, i8** %1, i64 %105
%107 = load i8*, i8** %106
%108 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([4 x i8], [4 x i8]* @.str.13, i64 0, i64 0), i8* %107)
%109 = add nuw nsw i64 %105, 1
%110 = icmp eq i64 %109, %103
br i1 %110, label %111, label %104
111: ; preds = %104, %98
%112 = call i32 @putchar(i32 10)
%113 = load i32, i32* @stdout
%114 = call i32 @fflush(i32 %113)
%115 = getelementptr inbounds i8*, i8** %1, i64 1
%116 = load i8*, i8** %115
%117 = call i32 @execvp(i8* %116, i8** %115)
%118 = call i32 @perror(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.15, i64 0, i64 0))
br label %119
119: ; preds = %111, %94, %82, %72, %62, %46, %36, %27, %15
ret i32 1
}