I think that a program that is set 4755 (priv bits)...
a user with a UID of 100 and a GID of 100, I can set my executable file :
chmod 4755 foo
with foo.c containing setuid(0) ; setgid(0); system("bash");.....
and It does NOT spawn a root shell.
Of course not. SUID and SGID stand for "set user id" and "set group
id", not "set root id" and "set root group;" they are not "privilege
bits" per se. So your foo program, when invoked (4755), will set have
its userid set to be you, and the group id unaffected. Since you, as
a user, are not permitted to setuid(0), neither is your program. :-)
-- Kris