title: what can cause a socket() "Permission denied" error?
body: <p>Under Android 4, the following simple native C code line fails with an <strong><code>Permission denied</code></strong> error <strong>when <em>not</em> run as <code>root</code></strong>:</p>
  
  <pre><code>online_socket = socket(AF_INET, SOCK_DGRAM, 0);
  </code></pre>
  
  <p>I <em>do</em> have <code>root</code> access to the device, but want to run the process as non-privileged user.</p>
  
  <p>Note that the error happens even before binding the socket.</p>
  
  <p>I guess there is some security setting that needs to be tweaked? Anyone can tell me where to look?</p>
  
  <p>The O/S is really Android in this case, but I guess the problem is really Linux-related (since Android is based on a Linux Kernel).</p>
  
  <p><em>For those wondering: This is a custom program that runs in a full (<code>debootstrap</code>ped) Debian Jessie installation running in an Android 4 environment.</em></p>
  
  <h1>Update</h1>
  
  <p>I've learned that the Android Kernel has a special <code>CONFIG_ANDROID_PARANOID_NETWORK</code> extension that allows network access only to users in <code>AID_INET</code> and <code>AID_NET_RAW</code> groups.</p>
  
  <p>However, even after adding the user to these groups, <code>socket()</code> is still rejected (and <code>ping</code> appears to have the same problem, BTW).</p>
  
  <pre><code>uid=5(imp) gid=51(imp) groups=51(imp),3003(aid_inet),3004(aid_net_raw),3005(aid_admin),3001(aid_bt),3002(aid_bt_net)
  </code></pre>
  
  <p>I can't tell if that <code>CONFIG_ANDROID_PARANOID_NETWORK</code> flag is set in this particular Kernel, as I don't have access to the config file.</p>
  
  <h1>Update 2</h1>
  
  <p>I found out that both <code>root</code> <em>and</em> also my unprivileged user <code>imp</code> can in fact successfully call <code>socket()</code> - at least with the groups setup described above.</p>
  
  <p>However, calling the same process as <code>root</code> and then switching to <code>imp</code> using the <strong><code>seteuid()</code></strong> system call prevents <code>socket()</code> from succeeding. Any ideas?</p>