Skip to content



setresuid16 - set real, effective and saved user identity


The setresuid16 syscall sets the effective, real, and saved user identities depending on the value of the argument flags. A process with the CAP_SETUID capability can set its own user ID's. A process without the CAP_SETUID capability can set the real and effective user ID's to the effective user ID of the process. All the ID's are changed regardless of the value of the flags argument, so group and supplemental group changes can not be suppressed.


  • ruid:old_uid_t[K] - real user ID
  • euid:old_uid_t[K] - effective user ID
  • suid:old_uid_t[K] - saved set-user-ID

Available Tags

  • K - Originated from kernel-space.






To monitor changes in user ID's.

Example Use Case

An example of a use case for this event is if a system administrator wanted to monitor user ID changes as they occur. This event can be used to detect any attempts to change a user's identity in order to access resources they are not authorized to access.


There are no known issues with this event.

  • getresuid16 - get real, effective, and saved user identity
  • setreuid16 - set real and effective user identity
  • setfsuid16 - set filesystem user identity

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.