void do_change_user(int afdt_fd) {
  std::string uname;
  lwp_read(afdt_fd, uname);
  if (!uname.length()) return;

  auto buf = PasswdBuffer{};
  struct passwd *pw;
  if (getpwnam_r(uname.c_str(), &buf.ent, buf.data.get(), buf.size, &pw)) {
    // TODO(alexeyt) should we log something and/or fail to start?
    return;
  }
  if (!pw) {
    // TODO(alexeyt) should we log something and/or fail to start?
    return;
  }

  if (pw->pw_gid) {
    initgroups(pw->pw_name, pw->pw_gid);
    setgid(pw->pw_gid);
  }
  if (pw->pw_uid) {
    setuid(pw->pw_uid);
  }
}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.