{"record":{"id":"6823c0480333d078","repo":"AdguardTeam/AdGuardHome","slug":"setting-uid-w","errorCode":null,"errorMessage":"setting uid: %w","messagePattern":"setting uid: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/aghos/user_unix.go","lineNumber":44,"sourceCode":"\t}\n\n\treturn nil\n}\n\nfunc setUser(userName string) (err error) {\n\tu, err := user.Lookup(userName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"looking up user: %w\", err)\n\t}\n\n\tuid, err := strconv.Atoi(u.Uid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parsing uid: %w\", err)\n\t}\n\n\terr = syscall.Setuid(uid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"setting uid: %w\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":26,"sourceCodeEnd":49,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/aghos/user_unix.go#L26-L49","documentation":"The final step of setUser: syscall.Setuid(uid) failed. Setuid requires root or CAP_SETUID and fails with EPERM when unprivileged, EINVAL for an invalid uid; it is also irreversible, so ordering matters in privilege-dropping code.","triggerScenarios":"Running the process as non-root while a user: is configured; containers lacking CAP_SETUID; attempting to change uid after privileges were already dropped; uid out of range for the kernel.","commonSituations":"Systemd units running as unprivileged users with user: still set in config; Docker with dropped capabilities; security-hardened environments blocking identity changes.","solutions":["Run as root or grant CAP_SETUID (systemd: AmbientCapabilities=CAP_SETUID, Docker: --cap-add SETUID)","Remove the user: config option if the service is meant to run unprivileged","Ensure setUser is invoked before any other privilege-dropping step"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if syscall.Geteuid() != 0 { /* skip user switching or require CAP_SETUID */ }","typeGuard":null,"tryCatchPattern":"if err != nil && errors.Is(err, syscall.EPERM) { /* grant CAP_SETUID or drop user: config */ }","preventionTips":["Grant CAP_SETUID when a user is configured","Call setUser before other privilege drops","In Docker, don't --cap-drop SETUID if switching users"],"tags":["unix","setuid","eperm","privileges","syscall"],"backgroundTag":"setuid-permission-denied","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}