container: move PR_SET_NO_NEW_PRIVS to parent

This allows some LSM setup in the parent.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 8 insertions, 0 deletions

diff --git a/container/syscall.go b/container/syscall.go
index 075da89a..62b85c55 100644
--- a/container/syscall.go
+++ b/container/syscall.go
@@ -18,6 +18,14 @@ func SetDumpable(dumpable uintptr) error {
 	return nil
 }
 
+func SetNoNewPrivs() error {
+	_, _, errno := syscall.Syscall(syscall.SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0)
+	if errno == 0 {
+		return nil
+	}
+	return errno
+}
+
 // IgnoringEINTR makes a function call and repeats it if it returns an
 // EINTR error. This appears to be required even though we install all
 // signal handlers with SA_RESTART: see #22838, #38033, #38836, #40846.