process-util: introduce trivial proc_set_nnp() helper

diff --git a/src/basic/process-util.c b/src/basic/process-util.c
index 1f7bdedc16e9fb27692a894a3928212df2a6bc1c..076d403762ae8600476b9e75e5f7174963eed83b 100644 (file)
--- a/src/basic/process-util.c
+++ b/src/basic/process-util.c
@@ -2292,3 +2292,7 @@ int prctl_safe(int op, unsigned long arg2, unsigned long arg3, unsigned long arg
 int proc_set_comm(const char *comm) {
         return prctl_safe(PR_SET_NAME, (unsigned long) comm, 0, 0, 0);
 }
+
+int proc_set_nnp(void) {
+        return prctl_safe(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+}

diff --git a/src/basic/process-util.h b/src/basic/process-util.h
index 0bdd8077b5652c2ba98a04d5969af2bafdf95b40..0d956c1606ab16fd5a12d2d66de05ca386455508 100644 (file)
--- a/src/basic/process-util.h
+++ b/src/basic/process-util.h
@@ -259,3 +259,4 @@ int read_errno(int errno_fd);
 int prctl_safe(int op, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5);
 
 int proc_set_comm(const char *comm);
+int proc_set_nnp(void);

diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index b232cd015cc0ef49bb1f2a551471901709fd5db9..81ca984111a2cfe93e2b8231145437026ea1d994 100644 (file)
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -6479,11 +6479,13 @@ int exec_invoke(
                         }
                 }
 
-                if (context_has_no_new_privileges(context))
-                        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+                if (context_has_no_new_privileges(context)) {
+                        r = proc_set_nnp();
+                        if (r < 0) {
                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
-                                return log_error_errno(errno, "Failed to disable new privileges: %m");
+                                return log_error_errno(r, "Failed to disable new privileges: %m");
                         }
+                }
 
 #if HAVE_SECCOMP
                 r = apply_address_families(context, params);

diff --git a/src/core/main.c b/src/core/main.c
index d67146a7ede17678865d8b518dcd0ff54a291174..663b6d6f5f89d335486ad320c7893ca9d05ccd0b 100644 (file)
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -2739,9 +2739,10 @@ static int initialize_runtime(
                 }
 
                 if (arg_no_new_privs) {
-                        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+                        r = proc_set_nnp();
+                        if (r < 0) {
                                 *ret_error_message = "Failed to disable new privileges";
-                                return log_struct_errno(LOG_EMERG, errno,
+                                return log_struct_errno(LOG_EMERG, r,
                                                         LOG_MESSAGE("Failed to disable new privileges: %m"),
                                                         LOG_MESSAGE_ID(SD_MESSAGE_CORE_DISABLE_PRIVILEGES_STR));
                         }

diff --git a/src/import/import-common.c b/src/import/import-common.c
index 41e945f1fb72949360a0aceb8847bda4ea4810d8..0168311204c57007dc3bf151444ee56d831ec106 100644 (file)
--- a/src/import/import-common.c
+++ b/src/import/import-common.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <sched.h>
-#include <sys/prctl.h>
 #include <unistd.h>
 
 #include "sd-event.h"
@@ -81,8 +80,9 @@ int import_fork_tar_x(int tree_fd, int userns_fd, PidRef *ret_pid) {
                 if (r < 0)
                         log_debug_errno(r, "Failed to drop capabilities, ignoring: %m");
 
-                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
-                        log_warning_errno(errno, "Failed to enable PR_SET_NO_NEW_PRIVS, ignoring: %m");
+                r = proc_set_nnp();
+                if (r < 0)
+                        log_warning_errno(r, "Failed to enable PR_SET_NO_NEW_PRIVS, ignoring: %m");
 
                 if (tar_x(pipefd[0], tree_fd, flags) < 0)
                         _exit(EXIT_FAILURE);
@@ -141,8 +141,9 @@ int import_fork_tar_c(int tree_fd, int userns_fd, PidRef *ret_pid) {
                 if (r < 0)
                         log_debug_errno(r, "Failed to drop capabilities, ignoring: %m");
 
-                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
-                        log_warning_errno(errno, "Failed to enable PR_SET_NO_NEW_PRIVS, ignoring: %m");
+                r = proc_set_nnp();
+                if (r < 0)
+                        log_warning_errno(r, "Failed to enable PR_SET_NO_NEW_PRIVS, ignoring: %m");
 
                 if (tar_c(tree_fd, pipefd[1], /* filename= */ NULL, flags) < 0)
                         _exit(EXIT_FAILURE);

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index f4d85c0418d7a0680874b8b7f6942d0fe9f520c9..13d54364157ed54a4037ea396678bc45875e9be8 100644 (file)
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -3593,9 +3593,11 @@ static int inner_child(
         if (r < 0)
                 return log_error_errno(r, "Dropping capabilities failed: %m");
 
-        if (arg_no_new_privileges)
-                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
-                        return log_error_errno(errno, "Failed to disable new privileges: %m");
+        if (arg_no_new_privileges) {
+                r = proc_set_nnp();
+                if (r < 0)
+                        return log_error_errno(r, "Failed to disable new privileges: %m");
+        }
 
         /* LXC sets container=lxc, so follow the scheme here */
         envp[n_env++] = strjoina("container=", arg_container_service_name);