1 files changed, 21 insertions, 0 deletions

diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index e0cfec2490aa..711e0a30aacc 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -113,6 +113,12 @@
 # define PR_SET_MM_START_STACK          5
 # define PR_SET_MM_START_BRK            6
 # define PR_SET_MM_BRK                  7
+# define PR_SET_MM_ARG_START            8
+# define PR_SET_MM_ARG_END              9
+# define PR_SET_MM_ENV_START            10
+# define PR_SET_MM_ENV_END              11
+# define PR_SET_MM_AUXV                 12
+# define PR_SET_MM_EXE_FILE             13
 
 /*
  * Set specific pid that is allowed to ptrace the current task.
@@ -124,4 +130,19 @@
 #define PR_SET_CHILD_SUBREAPER 36
 #define PR_GET_CHILD_SUBREAPER 37
 
+/*
+ * If no_new_privs is set, then operations that grant new privileges (i.e.
+ * execve) will either fail or not grant them.  This affects suid/sgid,
+ * file capabilities, and LSMs.
+ *
+ * Operations that merely manipulate or drop existing privileges (setresuid,
+ * capset, etc.) will still work.  Drop those privileges if you want them gone.
+ *
+ * Changing LSM security domain is considered a new privilege.  So, for example,
+ * asking selinux for a specific new context (e.g. with runcon) will result
+ * in execve returning -EPERM.
+ */
+#define PR_SET_NO_NEW_PRIVS 38
+#define PR_GET_NO_NEW_PRIVS 39
+
 #endif /* _LINUX_PRCTL_H */