`setreuid` / `setregid` Saved ID is Not Updated on Real ID Change when `e == -1`

[doanbaotrung]

Description

In proc-identity.c, the macro DEFINE_SETRE handles setting the real and effective IDs:

        if (e != (uint32_t) -1) {
            eff = e;
            if (r != (uint32_t) -1 || e != old_real)
                saved = e;
        }

If e == -1 but r != -1, the entire if (e != (uint32_t) -1) block is skipped.

According to Linux behavior, if the real UID/GID is set, the saved ID must be updated to the new effective ID, even if the effective ID itself was not changed (e == -1).

Impact

Applications that rotate/swap real and effective IDs (a standard pattern in security-sensitive programs using setreuid) will experience incorrect saved-set-user-ID state, leading to permissions discrepancies or unexpected EPERM failures on subsequent calls.