diff options
| -rw-r--r-- | cmd/fsu/main.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/cmd/fsu/main.go b/cmd/fsu/main.go index 76343e27..0ba5a134 100644 --- a/cmd/fsu/main.go +++ b/cmd/fsu/main.go @@ -15,6 +15,8 @@ const ( fsuConfFile = "/etc/fsurc" envShim = "FORTIFY_SHIM" envAID = "FORTIFY_APP_ID" + + PR_SET_NO_NEW_PRIVS = 0x26 ) var Fmain = compPoison @@ -86,6 +88,9 @@ func main() { if err := syscall.Setresuid(uid, uid, uid); err != nil { log.Fatalf("cannot set uid: %v", err) } + if _, _, errno := syscall.AllThreadsSyscall(syscall.SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0); errno != 0 { + log.Fatalf("cannot set no_new_privs flag: %s", errno.Error()) + } if err := syscall.Exec(fmain, []string{"fortify", "shim"}, []string{envShim + "=" + shimSetupPath}); err != nil { log.Fatalf("cannot start shim: %v", err) } |