BSD syscall#354
svc · unix #354
setauid
Sets the calling process's audit user id (auid).
Prototype
int setauid(au_id_t *auid);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| auid | au_id_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 354 |
| xnu-1699.24.8 | macOS 10.7 Lion | 354 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 354 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 354 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 354 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 354 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 354 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 354 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 354 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 354 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 354 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 354 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 354 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 354 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 354 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 354 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 354 |
| xnu-10002.41.9 | — | 354 |
| xnu-10002.61.3 | — | 354 |
| xnu-10002.81.5 | — | 354 |
| xnu-10063.101.15 | — | 354 |
| xnu-10063.121.3 | — | 354 |
| xnu-10063.141.1 | — | 354 |
| xnu-11215.41.3 | — | 354 |
| xnu-11215.61.5 | — | 354 |
| xnu-11215.81.4 | — | 354 |
| xnu-11417.121.6 | — | 354 |
| xnu-11417.140.69 | — | 354 |
| xnu-12377.101.15 | — | 354 |
| xnu-12377.41.6 | — | 354 |
| xnu-12377.61.12 | — | 354 |
| xnu-12377.81.4 | — | 354 |
| xnu-1486.2.11 | — | 354 |
| xnu-1504.15.3 | — | 354 |
| xnu-1504.3.12 | — | 354 |
| xnu-1504.7.4 | — | 354 |
| xnu-1504.9.17 | — | 354 |
| xnu-1504.9.26 | — | 354 |
| xnu-1504.9.37 | — | 354 |
| xnu-1699.22.73 | — | 354 |
| xnu-1699.22.81 | — | 354 |
| xnu-1699.24.23 | — | 354 |
| xnu-1699.26.8 | — | 354 |
| xnu-1699.32.7 | — | 354 |
| xnu-2050.22.13 | — | 354 |
| xnu-2050.24.15 | — | 354 |
| xnu-2050.48.11 | — | 354 |
| xnu-2050.7.9 | — | 354 |
| xnu-2050.9.2 | — | 354 |
| xnu-2422.1.72 | — | 354 |
| xnu-2422.100.13 | — | 354 |
| xnu-2422.110.17 | — | 354 |
| xnu-2422.90.20 | — | 354 |
| xnu-2782.1.97 | — | 354 |
| xnu-2782.10.72 | — | 354 |
| xnu-2782.20.48 | — | 354 |
| xnu-2782.30.5 | — | 354 |
| xnu-3247.10.11 | — | 354 |
| xnu-3248.20.55 | — | 354 |
| xnu-3248.30.4 | — | 354 |
| xnu-3248.40.184 | — | 354 |
| xnu-3248.50.21 | — | 354 |
| xnu-3248.60.10 | — | 354 |
| xnu-3789.21.4 | — | 354 |
| xnu-3789.31.2 | — | 354 |
| xnu-3789.41.3 | — | 354 |
| xnu-3789.51.2 | — | 354 |
| xnu-3789.60.24 | — | 354 |
| xnu-3789.70.16 | — | 354 |
| xnu-4570.20.62 | — | 354 |
| xnu-4570.31.3 | — | 354 |
| xnu-4570.41.2 | — | 354 |
| xnu-4570.51.1 | — | 354 |
| xnu-4570.61.1 | — | 354 |
| xnu-4570.71.2 | — | 354 |
| xnu-4903.231.4 | — | 354 |
| xnu-4903.241.1 | — | 354 |
| xnu-4903.270.47 | — | 354 |
| xnu-6153.101.6 | — | 354 |
| xnu-6153.121.1 | — | 354 |
| xnu-6153.141.1 | — | 354 |
| xnu-6153.41.3 | — | 354 |
| xnu-6153.61.1 | — | 354 |
| xnu-6153.81.5 | — | 354 |
| xnu-7195.101.1 | — | 354 |
| xnu-7195.121.3 | — | 354 |
| xnu-7195.141.2 | — | 354 |
| xnu-7195.60.75 | — | 354 |
| xnu-7195.81.3 | — | 354 |
| xnu-8019.61.5 | — | 354 |
| xnu-8019.80.24 | — | 354 |
| xnu-8020.101.4 | — | 354 |
| xnu-8020.121.3 | — | 354 |
| xnu-8020.140.41 | — | 354 |
| xnu-8792.61.2 | — | 354 |
| xnu-8792.81.2 | — | 354 |
| xnu-8796.101.5 | — | 354 |
| xnu-8796.121.2 | — | 354 |
| xnu-8796.141.3 | — | 354 |
Notes
setauid(2) is the lowest-level way to write auid and is restricted to the audit_control privilege. Once set to a non-(-1) value the auid is sticky for the lifetime of the process and its descendants, so misuse permanently misattributes every downstream audit record. Legitimate callers are essentially only login, sshd, sudo, su and securityd.
Detection
Emits AUE_SETAUID; auid changes are also visible by diffing audit_token_t between consecutive ES events. Any attempt to set auid to 0 or -1 from an unprivileged-spawned process is high-fidelity evidence of audit-evasion tooling.
Related APIs
getauidsetaudit_addraudit_token_to_auid