LDP
/
man-pages
mirror of https://github.com/mkerrisk/man-pages
0
1
Fork 0
Code Releases Activity

prctl.2: document PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW_PRIVS 

This adds a short description of the no_new_privs bit,
as described in Documentation/prctl/no_new_privs.txt.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
This commit is contained in:
Kees Cook 2012-10-22 09:13:08 +02:00 committed by Michael Kerrisk
parent 6239dfb213
commit f83fe154a8
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
man2/prctl.2
View File

@ -42,6 +42,7 @@
.\" 2012-04-25 Michael Kerrisk, Document PR_TASK_PERF_EVENTS_DISABLE and
.\" PR_TASK_PERF_EVENTS_ENABLE
.\" 2012-09-20 Kees Cook, update PR_SET_SECCOMP for mode 2
.\" 2012-09-20 Kees Cook, document PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW_PRIVS
.\"
.\" FIXME: Document PR_SET_TIMERSLACK and PR_GET_TIMERSLACK (new in 2.6.28)
.\" commit 6976675d94042fbd446231d1bd8b7de71a980ada
@ -216,6 +217,19 @@ in the buffer pointed to by
The buffer should allow space for up to 16 bytes;
the returned string will be null-terminated if it is shorter than that.
.TP
.BR PR_SET_NO_NEW_PRIVS " (since Linux 3.5)"
Set the current process's \fIno_new_privs\fP bit to the value in
\fIarg2\fP. With \fIno_new_privs\fP set to 1, execve promises not
to grant the privilege to do anything that could not have been done
without the execve call (for example, rendering setuid, setgid, and file
capabilities non-functional). When enabled, this value is inherited
across fork, clone, and execve and cannot be unset.
.TP
.BR PR_GET_NO_NEW_PRIVS " (since Linux 3.5)"
Return the value of the \fIno_new_privs\fP bit for the current process. A
value of 0 indicates the regular execve behavior. A value of 1 indicates
execve will operate in the privilege restricting mode described above.
.TP
.BR PR_SET_PDEATHSIG " (since Linux 2.1.57)"
Set the parent process death signal
of the calling process to \fIarg2\fP (either a signal value
@ -576,6 +590,7 @@ option.
On success,
.BR PR_GET_DUMPABLE ,
.BR PR_GET_KEEPCAPS ,
.BR PR_GET_NO_NEW_PRIVS ,
.BR PR_CAPBSET_READ ,
.BR PR_GET_TIMING ,
.BR PR_GET_SECUREBITS ,