privilege

func DropPrivileges ¶

func DropPrivileges(username, groupname, chrootPath string) error

DropPrivileges performs user/group lookup, chroot, and privilege drop in the correct order.

The sequence is:

1. Resolve user/group to numeric UID/GID (before chroot, needs /etc/passwd).
2. Validate essential DNS files inside the chroot directory.
3. chroot() into the target directory.
4. setgroups() — sets supplementary groups while still root.
5. setgid() — must happen before setuid() to retain root for the call.
6. setuid() — last step, drops all remaining privileges.

All parameters are optional. If all are empty, DropPrivileges is a no-op.