path: root/Documentation/prctl
diff options
authorAndy Lutomirski <luto@amacapital.net>2012-07-05 11:23:24 -0700
committerJames Morris <james.l.morris@oracle.com>2012-07-08 00:25:48 +1000
commitc540521bba5d2f24bd2c0417157bfaf8b85e2eee (patch)
tree64d387e5910f377b178bb168659684a0f09b20c2 /Documentation/prctl
parent26c439d4005d94b8da28e023e285fd4a9943470e (diff)
security: Minor improvements to no_new_privs documentation
The documentation didn't actually mention how to enable no_new_privs. This also adds a note about possible interactions between no_new_privs and LSMs (i.e. why teaching systemd to set no_new_privs is not necessarily a good idea), and it references the new docs from include/linux/prctl.h. Suggested-by: Rob Landley <rob@landley.net> Signed-off-by: Andy Lutomirski <luto@amacapital.net> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'Documentation/prctl')
1 files changed, 7 insertions, 0 deletions
diff --git a/Documentation/prctl/no_new_privs.txt b/Documentation/prctl/no_new_privs.txt
index cb705ec69abe..f7be84fba910 100644
--- a/Documentation/prctl/no_new_privs.txt
+++ b/Documentation/prctl/no_new_privs.txt
@@ -25,6 +25,13 @@ bits will no longer change the uid or gid; file capabilities will not
add to the permitted set, and LSMs will not relax constraints after
+To set no_new_privs, use prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0).
+Be careful, though: LSMs might also not tighten constraints on exec
+in no_new_privs mode. (This means that setting up a general-purpose
+service launcher to set no_new_privs before execing daemons may
+interfere with LSM-based sandboxing.)
Note that no_new_privs does not prevent privilege changes that do not
involve execve. An appropriately privileged task can still call
setuid(2) and receive SCM_RIGHTS datagrams.

Privacy Policy