---
name: "setuids.bt"
section: "8"
platform: "linux"
package: "bpftrace"
version: "0.27.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/setuids.bt"
---

# setuids.bt(8)

Trace setuid family of syscalls. Uses bpftrace/eBPF.

## NAME

setuids.bt - Trace setuid family of syscalls. Uses bpftrace/eBPF.

## SYNOPSIS

**setuids.bt**

## DESCRIPTION

This tool traces privilege escalation via setuid syscalls, and can be used for debugging, whitelist creation, and intrusion detection.

It works by tracing the [setuid(2)](/setuid/2.md), [setfsuid(2)](/setfsuid/2.md), and retresuid(2) syscalls using the syscall tracepoints.

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF and bpftrace.

## EXAMPLES

- Trace setuid syscalls:

  \# **setuids.bt**

## FIELDS

- PID

  The calling process ID.

- COMM

  The calling process (thread) name.

- UID

  The UID of the caller.

- SYSCALL

  The syscall name.

- ARGS

  The arguments to the syscall

- (RET)

  The return value for the syscall: 0 == success, other numbers indicate an error code.

## OVERHEAD

setuid calls are expected to be low frequency (\<\< 100/s), so the overhead of this tool is expected to be negligible.

## SOURCE

This tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

-

  http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool.

This version is in the bpftrace repository:

-

  https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg

## SEE ALSO

[capable.bt(8)](/capable.bt/8.md)