From 69a4ab81053ef31d745ac0d92531cefb7d3a3e44 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 18 Aug 2025 11:46:02 +0900 Subject: container: move PR_SET_NO_NEW_PRIVS to parent This allows some LSM setup in the parent. Signed-off-by: Ophestra --- container/syscall.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'container/syscall.go') diff --git a/container/syscall.go b/container/syscall.go index 075da89a..62b85c55 100644 --- a/container/syscall.go +++ b/container/syscall.go @@ -18,6 +18,14 @@ func SetDumpable(dumpable uintptr) error { return nil } +func SetNoNewPrivs() error { + _, _, errno := syscall.Syscall(syscall.SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0) + if errno == 0 { + return nil + } + return errno +} + // IgnoringEINTR makes a function call and repeats it if it returns an // EINTR error. This appears to be required even though we install all // signal handlers with SA_RESTART: see #22838, #38033, #38836, #40846. -- cgit v1.3.1