---
name: "uid_wrapper"
section: "1"
platform: "linux"
package: "libuid-wrapper"
version: "1.3.1-3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/uid_wrapper"
---

# uid\_wrapper(1)

A wrapper to fake privilege separation

## NAME

uid\_wrapper - A wrapper to fake privilege separation

## SYNOPSIS

LD\_PRELOAD=libuid\_wrapper.so UID\_WRAPPER=1 UID\_WRAPPER\_ROOT=1 **./myapplication**

## DESCRIPTION

• Allows uid switching as a normal user.

• Start any application making it believe it is running as root.

• Support for user/group changing in the local thread using the syscalls (like glibc).

• More precisely this library intercepts seteuid and related calls, and simulates them in a manner similar to the nss\_wrapper and socket\_wrapper libraries.

Some projects like a file server need privilege separation to be able to switch to the connection user and do file operations. uid\_wrapper convincingly lies to the application letting it believe it is operating as root and even switching between UIDs and GIDs as needed.

## ENVIRONMENT VARIABLES

**UID\_WRAPPER**

If you load the uid\_wrapper and enable it with setting UID\_WRAPPER=1 all setuid and setgid will work, even as a normal user.

**UID\_WRAPPER\_ROOT**

It is possible to start your application as fake root with setting UID\_WRAPPER\_ROOT=1.

**UID\_WRAPPER\_DEBUGLEVEL**

If you need to see what is going on in uid\_wrapper itself or try to find a bug, you can enable logging support in uid\_wrapper if you built it with debug symbols.

• 0 = ERROR

• 1 = WARNING

• 2 = DEBUG

• 3 = TRACE

**UID\_WRAPPER\_MYUID**

This environment variable can be used to tell uid\_wrapper to let geteuid() return the real (instead of the faked) UID of the user who started the process with uid\_wrapper.

```
uid_t uid;
setenv("UID_WRAPPER_MYUID", "1", 1);
uid = geteuid();
unsetenv("UID_WRAPPER_MYUID");
```

**UID\_WRAPPER\_DISABLE\_DEEPBIND**

This allows you to disable deep binding in uid\_wrapper. This is useful for running valgrind tools or sanitizers like (address, undefined, thread).

## EXAMPLE

```
$ LD_PRELOAD=libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT=1 id
uid=0(root) gid=0(root) 0(root)
```

## WORKAROUNDS

If you need to write code that behaves differently depending on whether uid\_wrapper is enabled or not, for example in cases where you have to file permissions, you can predefine the uid\_wrapper\_enabled() function in your project as follows:

```
bool uid_wrapper_enabled(void)
{
    return false;
}
```

Since uid\_wrapper overloads this function if enabled, you can use it in your code to detect uid\_wrapper.