Question

I see such logic in many open source projects:

if (setuid() == 0) {
   if (setgid(ccf->group) == -1) {
   ...
   if (initgroups(ccf->username, ccf->group) == -1) {

I have 2 questions on this:

1. What’s the benifit to change to another gid and uid?
2. And what’s initgroups for? IMO,to change gid and uid,setuid() and setgid() will be enough.

Answer 1

Most of the time, system daemons are spawned by init scripts and therefore run as root. Calling setuid() and setgid() allows them to drop their superuser privileges and impersonate another user on the system (generally far less powerful than root). That way, bugs and security holes become less lethal to the system.

Concerning the second part of your question, initgroups() is called to reinitialize the group access list and add ccf->group to the list of groups that ccf->username belongs to. That’s probably done because calling setgid() is not sufficient for the access rights associated with the new group to be propagated to the process.