CGI, python, and setgid

Question

I'm running a compiled python cgi script (using cxfreeze) in Apache. The script, among other things, calls

os.setuid(some_uid)
os.setgid(some_gid)

Obviously some_uid/gid are legal and I set the sticky bit for both user and group, and verified it is indeed set. However on every call i get an error

os.setgid(int(self.gid))
OSError: [Errno 1] Operation not permitted

As you may notice, setuid() is successful, setgid() is not. Which is very weird, at least for me, though I admit I have little experience with permissions in Linux. Any thoughts/ideas are welcome.

I'm using apache 2.2.15, python 2.6.5, RHEL 5.4 (kernel 2.6.18)

Answer 1

The setuid call drops the privileges you need to call setgid, so your calls occur in the wrong order. But why not use a library that is designed for dropping privileges?