diff options
Diffstat (limited to 'Documentation/prctl/no_new_privs.txt')
| -rw-r--r-- | Documentation/prctl/no_new_privs.txt | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Documentation/prctl/no_new_privs.txt b/Documentation/prctl/no_new_privs.txt index cb705ec69abe..f7be84fba910 100644 --- a/Documentation/prctl/no_new_privs.txt +++ b/Documentation/prctl/no_new_privs.txt | |||
| @@ -25,6 +25,13 @@ bits will no longer change the uid or gid; file capabilities will not | |||
| 25 | add to the permitted set, and LSMs will not relax constraints after | 25 | add to the permitted set, and LSMs will not relax constraints after |
| 26 | execve. | 26 | execve. |
| 27 | 27 | ||
| 28 | To set no_new_privs, use prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0). | ||
| 29 | |||
| 30 | Be careful, though: LSMs might also not tighten constraints on exec | ||
| 31 | in no_new_privs mode. (This means that setting up a general-purpose | ||
| 32 | service launcher to set no_new_privs before execing daemons may | ||
| 33 | interfere with LSM-based sandboxing.) | ||
| 34 | |||
| 28 | Note that no_new_privs does not prevent privilege changes that do not | 35 | Note that no_new_privs does not prevent privilege changes that do not |
| 29 | involve execve. An appropriately privileged task can still call | 36 | involve execve. An appropriately privileged task can still call |
| 30 | setuid(2) and receive SCM_RIGHTS datagrams. | 37 | setuid(2) and receive SCM_RIGHTS datagrams. |