From 69a4ab81053ef31d745ac0d92531cefb7d3a3e44 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 18 Aug 2025 11:46:02 +0900 Subject: container: move PR_SET_NO_NEW_PRIVS to parent This allows some LSM setup in the parent. Signed-off-by: Ophestra --- container/container.go | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'container/container.go') diff --git a/container/container.go b/container/container.go index 8f90235c..52691cea 100644 --- a/container/container.go +++ b/container/container.go @@ -179,6 +179,12 @@ func (p *Container) Start() error { p.wait = make(chan struct{}) done <- func() error { // setup depending on per-thread state must happen here + // PR_SET_NO_NEW_PRIVS: depends on per-thread state but acts on all processes created from that thread + if err := SetNoNewPrivs(); err != nil { + return wrapErrSuffix(err, + "prctl(PR_SET_NO_NEW_PRIVS):") + } + msg.Verbose("starting container init") if err := p.cmd.Start(); err != nil { return msg.WrapErr(err, err.Error()) -- cgit v1.3.1