prctl(PR_SET_NO_NEW_PRIVS, 1) is enough, we don't require CAP_SYS_ADMIN
see
https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt
https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
static int __preload_main__(int argc, char **argv, char **envp)
{
- uid_t uid = getuid();
char *env_file = getenv("SECCOMP_FILE");
- if (uid) {
- INFO("preload-seccomp: %s: not root, cannot install seccomp filter\n", *argv);
- return -1;
- }
-
if (install_syscall_filter(*argv, env_file))
return -1;