#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ uid_t;
struct stat {
  int st_mode;
  scalar_t__ st_uid;
};

/* Variables and functions */
int /*<<< orphan*/ O_RDWR;
scalar_t__ S_ISLNK(int);
int chdir(char const *);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ execvp(char *, char **);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
scalar_t__ fork();
int lstat(char *, struct stat *);
int open(char *, int /*<<< orphan*/);
int stat(char *, struct stat *);
int trylock(int);
void doit(const char *username, const char *dir, uid_t u) {
  struct stat sb;
  char *execline[] = {
      "runas", "xxx", "noroot", "chdirhome", "subsvscan", ".service", 0,
  };
  int fd, r;
  if (chdir(dir) == -1)
    return;
  if (lstat(".service", &sb) == -1)
    return;
  if (S_ISLNK(sb.st_mode))
    return;
  if (chdir(".service") == -1)
    return;
  if (stat(".", &sb) == -1)
    return;
  if (sb.st_uid != u)
    return;
  if (sb.st_mode & 022)
    return;
  if (stat("..", &sb) == -1)
    return;
  if (sb.st_uid != u)
    return;
  if (sb.st_mode & 02)
    return;
  fd = open(".lock", O_RDWR);
  if (fd != -1) {
    r = trylock(fd);
    (void)close(fd);
    if (r < 1)
      return;
  }
  if (fork() == 0) {
    execline[1] = (void *)username;
    execvp(*execline, execline);
    exit(0);
  }
}


x86 assembly (clang, -O0):
<doit>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
lea    -0x60(%rbp),%rdi
xor    %esi,%esi
mov    $0x38,%edx
call   1060 <memset@plt>
lea    0xe25(%rip),%rax
mov    %rax,-0x60(%rbp)
lea    0xe20(%rip),%rax
mov    %rax,-0x58(%rbp)
lea    0xe19(%rip),%rax
mov    %rax,-0x50(%rbp)
lea    0xe15(%rip),%rax
mov    %rax,-0x48(%rbp)
lea    0xe14(%rip),%rax
mov    %rax,-0x40(%rbp)
lea    0xe13(%rip),%rax
mov    %rax,-0x38(%rbp)
mov    -0x10(%rbp),%rdi
call   1050 <chdir@plt>
cmp    $0xffffffff,%eax
jne    122d <doit+0x7d>
jmp    137c <doit+0x1cc>
lea    0xdf1(%rip),%rdi
lea    -0x28(%rbp),%rsi
call   1080 <lstat@plt>
cmp    $0xffffffff,%eax
jne    124b <doit+0x9b>
jmp    137c <doit+0x1cc>
mov    -0x28(%rbp),%edi
call   1040 <S_ISLNK@plt>
cmp    $0x0,%rax
je     1262 <doit+0xb2>
jmp    137c <doit+0x1cc>
lea    0xdbc(%rip),%rdi
call   1050 <chdir@plt>
cmp    $0xffffffff,%eax
jne    127c <doit+0xcc>
jmp    137c <doit+0x1cc>
lea    0xdac(%rip),%rdi
lea    -0x28(%rbp),%rsi
call   1090 <stat@plt>
cmp    $0xffffffff,%eax
jne    129a <doit+0xea>
jmp    137c <doit+0x1cc>
mov    -0x20(%rbp),%rax
cmp    -0x18(%rbp),%rax
je     12ad <doit+0xfd>
jmp    137c <doit+0x1cc>
mov    -0x28(%rbp),%eax
and    $0x12,%eax
cmp    $0x0,%eax
je     12c1 <doit+0x111>
jmp    137c <doit+0x1cc>
lea    0xd66(%rip),%rdi
lea    -0x28(%rbp),%rsi
call   1090 <stat@plt>
cmp    $0xffffffff,%eax
jne    12df <doit+0x12f>
jmp    137c <doit+0x1cc>
mov    -0x20(%rbp),%rax
cmp    -0x18(%rbp),%rax
je     12f2 <doit+0x142>
jmp    137c <doit+0x1cc>
mov    -0x28(%rbp),%eax
and    $0x2,%eax
cmp    $0x0,%eax
je     1306 <doit+0x156>
jmp    137c <doit+0x1cc>
mov    0x2cdb(%rip),%rax
mov    (%rax),%esi
lea    0xd1b(%rip),%rdi
call   10a0 <open@plt>
mov    %eax,-0x64(%rbp)
cmpl   $0xffffffff,-0x64(%rbp)
je     134f <doit+0x19f>
mov    -0x64(%rbp),%edi
call   1030 <trylock@plt>
mov    %eax,-0x68(%rbp)
mov    -0x64(%rbp),%edi
call   1070 <close@plt>
cmpl   $0x1,-0x68(%rbp)
jge    134a <doit+0x19a>
jmp    137c <doit+0x1cc>
jmp    134f <doit+0x19f>
mov    $0x0,%al
call   10d0 <fork@plt>
cmp    $0x0,%rax
jne    137c <doit+0x1cc>
mov    -0x8(%rbp),%rax
mov    %rax,-0x58(%rbp)
mov    -0x60(%rbp),%rdi
lea    -0x60(%rbp),%rsi
call   10b0 <execvp@plt>
xor    %edi,%edi
call   10c0 <exit@plt>
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<doit>:
push   %rbp
push   %r14
push   %rbx
sub    $0x50,%rsp
mov    %rdx,%rbx
mov    %rdi,%r14
xorps  %xmm0,%xmm0
movaps %xmm0,0x10(%rsp)
movaps %xmm0,0x20(%rsp)
movaps %xmm0,0x30(%rsp)
movq   $0x0,0x40(%rsp)
lea    0xe30(%rip),%rax
mov    %rax,0x10(%rsp)
lea    0xe2a(%rip),%rax
mov    %rax,0x20(%rsp)
lea    0xe25(%rip),%rax
mov    %rax,0x28(%rsp)
lea    0xe23(%rip),%rax
mov    %rax,0x30(%rsp)
lea    0xe21(%rip),%rax
mov    %rax,0x38(%rsp)
mov    %rsi,%rdi
call   1050 <chdir@plt>
cmp    $0xffffffff,%eax
je     1233 <doit+0x93>
lea    0xe08(%rip),%rdi
mov    %rsp,%rsi
call   1070 <lstat@plt>
cmp    $0xffffffff,%eax
je     1233 <doit+0x93>
mov    (%rsp),%edi
call   1040 <S_ISLNK@plt>
test   %rax,%rax
je     123c <doit+0x9c>
add    $0x50,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret
lea    0xdde(%rip),%rdi
call   1050 <chdir@plt>
cmp    $0xffffffff,%eax
je     1233 <doit+0x93>
lea    0xdd7(%rip),%rdi
mov    %rsp,%rsi
call   1080 <stat@plt>
cmp    $0xffffffff,%eax
je     1233 <doit+0x93>
cmp    %rbx,0x8(%rsp)
jne    1233 <doit+0x93>
testb  $0x12,(%rsp)
jne    1233 <doit+0x93>
lea    0xdb5(%rip),%rdi
mov    %rsp,%rsi
call   1080 <stat@plt>
cmp    $0xffffffff,%eax
je     1233 <doit+0x93>
cmp    %rbx,0x8(%rsp)
jne    1233 <doit+0x93>
testb  $0x2,(%rsp)
jne    1233 <doit+0x93>
mov    0x2d52(%rip),%rax
mov    (%rax),%esi
lea    0xd8e(%rip),%rdi
call   1090 <open@plt>
cmp    $0xffffffff,%eax
je     12c3 <doit+0x123>
mov    %eax,%ebx
mov    %eax,%edi
call   1030 <trylock@plt>
mov    %eax,%ebp
mov    %ebx,%edi
call   1060 <close@plt>
test   %ebp,%ebp
jle    1233 <doit+0x93>
xor    %eax,%eax
call   10c0 <fork@plt>
test   %rax,%rax
jne    1233 <doit+0x93>
mov    %r14,0x18(%rsp)
lea    0xd21(%rip),%rdi
lea    0x10(%rsp),%rsi
call   10a0 <execvp@plt>
xor    %edi,%edi
call   10b0 <exit@plt>

LLVM IR (-O0):
%struct.stat = type { i32, i64 }
@.str = [6 x i8] c"runas\00"
@.str.1 = [4 x i8] c"xxx\00"
@.str.2 = [7 x i8] c"noroot\00"
@.str.3 = [10 x i8] c"chdirhome\00"
@.str.4 = [10 x i8] c"subsvscan\00"
@.str.5 = [9 x i8] c".service\00"
@.str.6 = [2 x i8] c".\00"
@.str.7 = [3 x i8] c"..\00"
@.str.8 = [6 x i8] c".lock\00"
@O_RDWR = global i32 0
define void @doit(i8* %0, i8* %1, i64 %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i64
%7 = alloca %struct.stat
%8 = alloca [7 x i8*]
%9 = alloca i32
%10 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
store i64 %2, i64* %6
%11 = bitcast [7 x i8*]* %8 to i8*
%12 = bitcast i8* %11 to [7 x i8*]*
%13 = getelementptr inbounds [7 x i8*], [7 x i8*]* %12, i32 0, i32 0
store i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i32 0, i32 0), i8** %13
%14 = getelementptr inbounds [7 x i8*], [7 x i8*]* %12, i32 0, i32 1
store i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i32 0, i32 0), i8** %14
%15 = getelementptr inbounds [7 x i8*], [7 x i8*]* %12, i32 0, i32 2
store i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i32 0, i32 0), i8** %15
%16 = getelementptr inbounds [7 x i8*], [7 x i8*]* %12, i32 0, i32 3
store i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i32 0, i32 0), i8** %16
%17 = getelementptr inbounds [7 x i8*], [7 x i8*]* %12, i32 0, i32 4
store i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i32 0, i32 0), i8** %17
%18 = getelementptr inbounds [7 x i8*], [7 x i8*]* %12, i32 0, i32 5
store i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i32 0, i32 0), i8** %18
%19 = load i8*, i8** %5
%20 = call i32 @chdir(i8* %19)
%21 = icmp eq i32 %20, -1
br i1 %21, label %22, label %23
22: ; preds = %3
br label %94
23: ; preds = %3
%24 = call i32 @lstat(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), %struct.stat* %7)
%25 = icmp eq i32 %24, -1
br i1 %25, label %26, label %27
26: ; preds = %23
br label %94
27: ; preds = %23
%28 = getelementptr inbounds %struct.stat, %struct.stat* %7, i32 0, i32 0
%29 = load i32, i32* %28
%30 = call i64 @S_ISLNK(i32 %29)
%31 = icmp ne i64 %30, 0
br i1 %31, label %32, label %33
32: ; preds = %27
br label %94
33: ; preds = %27
%34 = call i32 @chdir(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0))
%35 = icmp eq i32 %34, -1
br i1 %35, label %36, label %37
36: ; preds = %33
br label %94
37: ; preds = %33
%38 = call i32 @stat(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0), %struct.stat* %7)
%39 = icmp eq i32 %38, -1
br i1 %39, label %40, label %41
40: ; preds = %37
br label %94
41: ; preds = %37
%42 = getelementptr inbounds %struct.stat, %struct.stat* %7, i32 0, i32 1
%43 = load i64, i64* %42
%44 = load i64, i64* %6
%45 = icmp ne i64 %43, %44
br i1 %45, label %46, label %47
46: ; preds = %41
br label %94
47: ; preds = %41
%48 = getelementptr inbounds %struct.stat, %struct.stat* %7, i32 0, i32 0
%49 = load i32, i32* %48
%50 = and i32 %49, 18
%51 = icmp ne i32 %50, 0
br i1 %51, label %52, label %53
52: ; preds = %47
br label %94
53: ; preds = %47
%54 = call i32 @stat(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.7, i64 0, i64 0), %struct.stat* %7)
%55 = icmp eq i32 %54, -1
br i1 %55, label %56, label %57
56: ; preds = %53
br label %94
57: ; preds = %53
%58 = getelementptr inbounds %struct.stat, %struct.stat* %7, i32 0, i32 1
%59 = load i64, i64* %58
%60 = load i64, i64* %6
%61 = icmp ne i64 %59, %60
br i1 %61, label %62, label %63
62: ; preds = %57
br label %94
63: ; preds = %57
%64 = getelementptr inbounds %struct.stat, %struct.stat* %7, i32 0, i32 0
%65 = load i32, i32* %64
%66 = and i32 %65, 2
%67 = icmp ne i32 %66, 0
br i1 %67, label %68, label %69
68: ; preds = %63
br label %94
69: ; preds = %63
%70 = load i32, i32* @O_RDWR
%71 = call i32 @open(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.8, i64 0, i64 0), i32 %70)
store i32 %71, i32* %9
%72 = load i32, i32* %9
%73 = icmp ne i32 %72, -1
br i1 %73, label %74, label %83
74: ; preds = %69
%75 = load i32, i32* %9
%76 = call i32 @trylock(i32 %75)
store i32 %76, i32* %10
%77 = load i32, i32* %9
%78 = call i32 @close(i32 %77)
%79 = load i32, i32* %10
%80 = icmp slt i32 %79, 1
br i1 %80, label %81, label %82
81: ; preds = %74
br label %94
82: ; preds = %74
br label %83
83: ; preds = %82, %69
%84 = call i64 (...) @fork()
%85 = icmp eq i64 %84, 0
br i1 %85, label %86, label %94
86: ; preds = %83
%87 = load i8*, i8** %4
%88 = getelementptr inbounds [7 x i8*], [7 x i8*]* %8, i64 0, i64 1
store i8* %87, i8** %88
%89 = getelementptr inbounds [7 x i8*], [7 x i8*]* %8, i64 0, i64 0
%90 = load i8*, i8** %89
%91 = getelementptr inbounds [7 x i8*], [7 x i8*]* %8, i64 0, i64 0
%92 = call i32 @execvp(i8* %90, i8** %91)
%93 = call i32 @exit(i32 0)
unreachable
94: ; preds = %22, %26, %32, %36, %40, %46, %52, %56, %62, %68, %81, %83
ret void
}

LLVM IR (-O2):
%struct.stat = type { i32, i64 }
@.str = [6 x i8] c"runas\00"
@.str.2 = [7 x i8] c"noroot\00"
@.str.3 = [10 x i8] c"chdirhome\00"
@.str.4 = [10 x i8] c"subsvscan\00"
@.str.5 = [9 x i8] c".service\00"
@.str.6 = [2 x i8] c".\00"
@.str.7 = [3 x i8] c"..\00"
@.str.8 = [6 x i8] c".lock\00"
@O_RDWR = global i32 0
define void @doit(i8* %0, i8* %1, i64 %2) {
%4 = alloca %struct.stat
%5 = alloca [7 x i8*]
%6 = bitcast %struct.stat* %4 to i8*
%7 = bitcast [7 x i8*]* %5 to i8*
%8 = getelementptr inbounds [7 x i8*], [7 x i8*]* %5, i64 0, i64 0
store i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8** %8
%9 = getelementptr inbounds [7 x i8*], [7 x i8*]* %5, i64 0, i64 2
store i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i8** %9
%10 = getelementptr inbounds [7 x i8*], [7 x i8*]* %5, i64 0, i64 3
store i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0), i8** %10
%11 = getelementptr inbounds [7 x i8*], [7 x i8*]* %5, i64 0, i64 4
store i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0), i8** %11
%12 = getelementptr inbounds [7 x i8*], [7 x i8*]* %5, i64 0, i64 5
store i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), i8** %12
%13 = tail call i32 @chdir(i8* %1)
%14 = icmp eq i32 %13, -1
br i1 %14, label %62, label %15
15: ; preds = %3
%16 = call i32 @lstat(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), %struct.stat* %4)
%17 = icmp eq i32 %16, -1
br i1 %17, label %62, label %18
18: ; preds = %15
%19 = getelementptr inbounds %struct.stat, %struct.stat* %4, i64 0, i32 0
%20 = load i32, i32* %19
%21 = tail call i64 @S_ISLNK(i32 %20)
%22 = icmp eq i64 %21, 0
br i1 %22, label %23, label %62
23: ; preds = %18
%24 = tail call i32 @chdir(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0))
%25 = icmp eq i32 %24, -1
br i1 %25, label %62, label %26
26: ; preds = %23
%27 = call i32 @stat(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0), %struct.stat* %4)
%28 = icmp eq i32 %27, -1
br i1 %28, label %62, label %29
29: ; preds = %26
%30 = getelementptr inbounds %struct.stat, %struct.stat* %4, i64 0, i32 1
%31 = load i64, i64* %30
%32 = icmp eq i64 %31, %2
br i1 %32, label %33, label %62
33: ; preds = %29
%34 = load i32, i32* %19
%35 = and i32 %34, 18
%36 = icmp eq i32 %35, 0
br i1 %36, label %37, label %62
37: ; preds = %33
%38 = call i32 @stat(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.7, i64 0, i64 0), %struct.stat* %4)
%39 = icmp ne i32 %38, -1
%40 = load i64, i64* %30
%41 = icmp eq i64 %40, %2
%42 = select i1 %39, i1 %41, i1 false
br i1 %42, label %43, label %62
43: ; preds = %37
%44 = load i32, i32* %19
%45 = and i32 %44, 2
%46 = icmp eq i32 %45, 0
br i1 %46, label %47, label %62
47: ; preds = %43
%48 = load i32, i32* @O_RDWR
%49 = tail call i32 @open(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.8, i64 0, i64 0), i32 %48)
%50 = icmp eq i32 %49, -1
br i1 %50, label %55, label %51
51: ; preds = %47
%52 = tail call i32 @trylock(i32 %49)
%53 = tail call i32 @close(i32 %49)
%54 = icmp slt i32 %52, 1
br i1 %54, label %62, label %55
55: ; preds = %51, %47
%56 = tail call i64 (...) @fork()
%57 = icmp eq i64 %56, 0
br i1 %57, label %58, label %62
58: ; preds = %55
%59 = getelementptr inbounds [7 x i8*], [7 x i8*]* %5, i64 0, i64 1
store i8* %0, i8** %59
%60 = call i32 @execvp(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8** %8)
%61 = call i32 @exit(i32 0)
unreachable
62: ; preds = %55, %51, %43, %37, %33, %29, %26, %23, %18, %15, %3
ret void
}