Reproducer:

setuid.py

#!/usr/bin/env python3
import ctypes, os, pwd, sys, threading, time

SYS_setuid = 105  # setuid, x86_64
libc = ctypes.CDLL(None)
libc.syscall.restype = ctypes.c_long
libc.syscall.argtypes = [ctypes.c_long, ctypes.c_long]
uid = pwd.getpwnam(sys.argv[1]).pw_uid

def thread_func():
    libc.syscall(SYS_setuid, uid)
    while True:
        print(f"thread running as uid {uid} (pid={os.getpid()})", flush=True)
        time.sleep(5)

threading.Thread(target=thread_func, daemon=True).start()
time.sleep(60)

Start snippet as root. It's main thread has uid 0, spawned thread has uid of testuser. Then delete user while program is running.

sudo python3 setuid.py testuser &
sudo userdel testuser  # should detect thread running as testuser and abort, but doesn't detect and deletes testuser

Reproducer:

setuid.py

#!/usr/bin/env python3
import ctypes, os, pwd, sys, threading, time

SYS_setuid = 105  # setuid, x86_64
libc = ctypes.CDLL(None)
libc.syscall.restype = ctypes.c_long
libc.syscall.argtypes = [ctypes.c_long, ctypes.c_long]
uid = pwd.getpwnam(sys.argv[1]).pw_uid

def thread_func():
    libc.syscall(SYS_setuid, uid)
    while True:
        print(f"thread running as uid {uid} (pid={os.getpid()})", flush=True)
        time.sleep(5)

threading.Thread(target=thread_func, daemon=True).start()
time.sleep(60)

Start snippet as root. It's main thread has uid 0, spawned thread has uid of testuser. Then delete user while program is running.

sudo python3 setuid.py testuser &
sudo userdel testuser  # should detect thread running as testuser and abort, but doesn't detect and deletes testuser

Could you please use only C and sh(1) (or bash(1)) for the reproducer? Python is hard to understand to me.

Could you please use only C and sh(1) (or bash(1)) for the reproducer? Python is hard to understand to me.

Sure, try this:

setuid_thread.c

#include <pthread.h>
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>

static uid_t target_uid;

static void *user_thread(void *arg)
{
        syscall(SYS_setuid, (long)target_uid);
        for (;;) {
                printf("thread running as uid %d (pid=%d)\n", (int)target_uid,
                       (int)getpid());
                sleep(5);
        }
        return NULL;
}

int main(int argc, char *argv[])
{
        if (argc < 2) {
                fprintf(stderr, "Usage: %s <username>\n", argv[0]);
                return 1;
        }

        struct passwd *pw = getpwnam(argv[1]);
        if (!pw) {
                fprintf(stderr, "user not found: %s\n", argv[1]);
                return 1;
        }
        target_uid = pw->pw_uid;

        pthread_t tid;
        pthread_create(&tid, NULL, user_thread, NULL);
        sleep(60);
        return 0;
}

Then

gcc setuid_thread.c -o setuid_thread
sudo useradd --no-create-home testuser
sudo ./setuid_thread testuser &
sudo userdel testuser  # should detect thread running as testuser and abort, but doesn't detect and deletes testuser

Could you please use only C and sh(1) (or bash(1)) for the reproducer? Python is hard to understand to me.

Sure, try this:

Thanks!

setuid_thread.c

#include <pthread.h>
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>

static uid_t target_uid;

static void *user_thread(void *arg)
{
        syscall(SYS_setuid, (long)target_uid);

Is the raw system call needed, or can we call the glibc wrapper?

        setuid(target_uid);

From what you said, I think the raw syscall is necessary, but just to confirm.

        for (;;) {
                printf("thread running as uid %d (pid=%d)\n", (int)target_uid,
                       (int)getpid());
                sleep(5);
        }
        return NULL;
}

int main(int argc, char *argv[])
{
        if (argc < 2) {
                fprintf(stderr, "Usage: %s <username>\n", argv[0]);
                return 1;
        }

        struct passwd *pw = getpwnam(argv[1]);
        if (!pw) {
                fprintf(stderr, "user not found: %s\n", argv[1]);
                return 1;
        }
        target_uid = pw->pw_uid;

        pthread_t tid;
        pthread_create(&tid, NULL, user_thread, NULL);
        sleep(60);
        return 0;
}

Then

gcc setuid_thread.c -o setuid_thread
sudo useradd --no-create-home testuser
sudo ./setuid_thread testuser &
sudo userdel testuser  # should detect thread running as testuser and abort, but doesn't detect and deletes testuser

Is the raw system call needed,

Yes, see man 2 setuid:

At the kernel level, user IDs and group IDs are a per-thread
attribute.  However, POSIX requires that all threads in a process
share the same credentials.  The NPTL threading implementation
handles the POSIX requirements by providing wrapper functions for
the various system calls that change process UIDs and GIDs.  These
wrapper functions (including the one for setuid()) employ a
signal-based technique to ensure that when one thread changes
credentials, all of the other threads in the process also change
their credentials.

or can we call the glibc wrapper?

To my knowledge there's no other way than raw syscalls to get that Linux specific feature of different thread UIDs within one process.

Is the raw system call needed,

Yes, see man 2 setuid:

At the kernel level, user IDs and group IDs are a per-thread
attribute.  However, POSIX requires that all threads in a process
share the same credentials.  The NPTL threading implementation
handles the POSIX requirements by providing wrapper functions for
the various system calls that change process UIDs and GIDs.  These
wrapper functions (including the one for setuid()) employ a
signal-based technique to ensure that when one thread changes
credentials, all of the other threads in the process also change
their credentials.

or can we call the glibc wrapper?

To my knowledge there's no other way than raw syscalls to get that Linux specific feature of different thread UIDs within one process.

Thanks for conforming!

Could you please use only C and sh(1) (or bash(1)) for the reproducer? Python is hard to understand to me.

Sure, try this:

setuid_thread.c

#include <pthread.h>
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>

static uid_t target_uid;

static void *user_thread(void *arg)
{
        syscall(SYS_setuid, (long)target_uid);
        for (;;) {
                printf("thread running as uid %d (pid=%d)\n", (int)target_uid,
                       (int)getpid());
                sleep(5);
        }
        return NULL;
}

int main(int argc, char *argv[])
{
        if (argc < 2) {
                fprintf(stderr, "Usage: %s <username>\n", argv[0]);
                return 1;
        }

        struct passwd *pw = getpwnam(argv[1]);
        if (!pw) {
                fprintf(stderr, "user not found: %s\n", argv[1]);
                return 1;
        }
        target_uid = pw->pw_uid;

        pthread_t tid;
        pthread_create(&tid, NULL, user_thread, NULL);
        sleep(60);
        return 0;
}

Then

gcc setuid_thread.c -o setuid_thread
sudo useradd --no-create-home testuser
sudo ./setuid_thread testuser &
sudo userdel testuser  # should detect thread running as testuser and abort, but doesn't detect and deletes testuser

Could you please include this program (and the corresponding shell session below it) in the commit message? Please indent it, so that the includes are not treated as comments.

Thanks! It looks good. I'll test it tomorrow.