posix setgid() not working to de-escalate priviliges - dart

Question

I'm trying to create a function to de-escalate sudo privileges.
I'm the maintainer of a the package dcli which is a dart package intended to replace bash.
https://pub.dev/packages/dcli
One of my objectives is to allow a user to de-escalate sudo privileges back to the original user's privileges for some parts of the code:
If we have a script called touch_me.dart
The user would run:
sudo touch_me
The touch_me.dart script would be:
void main() {
test('isPriviliged', () {
try {
print('isPriviliged: ${Shell.current.isPrivilegedUser}');
print('uid: ${getuid()}');
print('gid: ${getgid()}');
print('euid: ${geteuid()}');
print('euid: ${geteuid()}');
print('user: ${getlogin()}');
print('SUDO_UID: ${env['SUDO_UID']}');
print('SUDO_USER: ${env['SUDO_USER']}');
print('SUDO_GUID: ${env['SUDO_GID']}');
print('de-escalating to: uid: $originalUID, gid: $originalGID');
print('pre-descalation euid: ${geteuid()}');
print('pre-descalation user egid: ${getegid()}');
releasePrivileges();
print('post-descalation euid: ${geteuid()}');
print('post-descalation user egid: ${getegid()}');
touch('test.txt', create: true);
'ls -la test.txt'.run;
withPrivileges(() {
print('with privileges euid: ${geteuid()}');
print('with privileges egid: ${getegid()}');
touch('test2.txt', create: true);
'ls -la test2.txt'.run;
});
} on PosixException catch (e, st) {
print(e);
print(st);
}
});
}
bool get isPrivilegedUser {
return _whoami() == 'root';
}
/// revert uid and gid to original user's id's
void releasePrivileges() {
if (Shell.current.isPrivilegedUser) {
var sUID = env['SUDO_UID'];
var gUID = env['SUDO_GID'];
// convert id's to integers.
var originalUID = sUID != null ? int.tryParse(sUID) ?? 0 : 0;
var originalGID = gUID != null ? int.tryParse(gUID) ?? 0 : 0;
setegid(originalGID);
seteuid(originalUID);
}
}
/// Run [privilegedCallback] with root UID and gid
void withPrivileges(RunPrivileged privilegedCallback) {
var privileged = Shell.current.isPrivilegedUser;
if (!privileged) {
setegid(0);
seteuid(0);
}
/// run the callback method with escalated privileges.
privilegedCallback();
/// If the code was originally running privileged then
/// we leave it as it was.
if (!privileged) {
releasePrivileges();
}
}
typedef RunPrivileged = void Function();
Everything works as expected except for the change to the gid. Even though releasePrivileges calls setegid(SUDO_GID) and SUDO_GID is 1000 the created file gets a gid of 0.
isPriviliged: true
uid: 0
gid: 0
euid: 0
euid: 0
user: bsutton
SUDO_UID: 1000
SUDO_USER: bsutton
SUDO_GUID: 1000
de-escalating to: uid: 1000, gid: 1000
pre-descalation euid: 0
pre-descalation user egid: 0
post-descalation euid: 1000
post-descalation user egid: 1000
-rw-r--r-- 1 bsutton root 0 Jan 18 10:23 test.txt
with privileges euid: 0
with privileges egid: 0
-rw-r--r-- 1 root root 0 Jan 18 10:23 test2.txt
Edit:
Here is the simplest example that demonstrates the problem:
void main() {
var sUID = env['SUDO_UID'];
var gUID = env['SUDO_GID'];
// convert id's to integers.
var originalUID = sUID != null ? int.tryParse(sUID) ?? 0 : 0;
var originalGID = gUID != null ? int.tryParse(gUID) ?? 0 : 0;
setegid(originalGID);
seteuid(originalUID);
touch('test.txt', create: true);
'ls -la test.txt'.run;
}

Answer 1

And the problem was my testing environment :<
In early tests I had accidently created test.txt with gid = 0.
If I re-run the test, deleting test.txt before I start, the code works as expected :<