PR_SET_NO_NEW_PRIVS - set the calling thread's no_new_privs attribute

Set the calling thread's no_new_privs attribute. With no_new_privs set to 1, execve(2) promises not to grant privileges to do anything that could not have been done without the execve(2) call (for example, rendering the set-user-ID and set-group-ID mode bits, and file capabilities non-functional). Once set, the no_new_privs attribute cannot be unset. The setting of this attribute is inherited by children created by fork(2) and clone(2), and preserved across execve(2).

EINVAL The second argument is not equal to 1L.

/proc/pid/status Since Linux 4.10, the value of a thread's no_new_privs attribute can be viewed via the NoNewPrivs field in this file.

Linux 3.5.

Standard C library (libc, -lc)

PR_SET_NO_NEW_PRIVS - set the calling thread's no_new_privs attribute

On success, 0 is returned. On error, -1 is returned, and errno is set to indicate the error.

prctl(2), PR_GET_NO_NEW_PRIVS(2const), seccomp(2) For more information, see the kernel source file Documentation/userspace-api/no_new_privs.rst (or Documentation/prctl/no_new_privs.txt before Linux 4.13). Linux man-pages 6.9.1 2024-06-01 PR_SET_NO_NEW_PRIVS(2const)

Linux.

#include<linux/prctl.h> /* Definition of PR_* constants */ #include<sys/prctl.h>intprctl(PR_SET_NO_NEW_PRIVS,1L,0L,0L,0L);