From: Lennart Poettering <lennart@amutable.com>
Date: Mon, 13 Jul 2026 08:48:05 +0000 (+0200)
Subject: process-util: introduce trivial proc_set_nnp() helper
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3ac3632e28870826d8d86f8d60495047ab29ecac;p=thirdparty%2Fsystemd.git

process-util: introduce trivial proc_set_nnp() helper
---

diff --git a/src/basic/process-util.c b/src/basic/process-util.c
index 1f7bdedc16e..076d403762a 100644
--- a/src/basic/process-util.c
+++ b/src/basic/process-util.c
@@ -2292,3 +2292,7 @@ int prctl_safe(int op, unsigned long arg2, unsigned long arg3, unsigned long arg
 int proc_set_comm(const char *comm) {
         return prctl_safe(PR_SET_NAME, (unsigned long) comm, 0, 0, 0);
 }
+
+int proc_set_nnp(void) {
+        return prctl_safe(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+}
diff --git a/src/basic/process-util.h b/src/basic/process-util.h
index 0bdd8077b56..0d956c1606a 100644
--- a/src/basic/process-util.h
+++ b/src/basic/process-util.h
@@ -259,3 +259,4 @@ int read_errno(int errno_fd);
 int prctl_safe(int op, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5);
 
 int proc_set_comm(const char *comm);
+int proc_set_nnp(void);
diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index b232cd015cc..81ca984111a 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -6479,11 +6479,13 @@ int exec_invoke(
                         }
                 }
 
-                if (context_has_no_new_privileges(context))
-                        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+                if (context_has_no_new_privileges(context)) {
+                        r = proc_set_nnp();
+                        if (r < 0) {
                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
-                                return log_error_errno(errno, "Failed to disable new privileges: %m");
+                                return log_error_errno(r, "Failed to disable new privileges: %m");
                         }
+                }
 
 #if HAVE_SECCOMP
                 r = apply_address_families(context, params);
diff --git a/src/core/main.c b/src/core/main.c
index d67146a7ede..663b6d6f5f8 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -2739,9 +2739,10 @@ static int initialize_runtime(
                 }
 
                 if (arg_no_new_privs) {
-                        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+                        r = proc_set_nnp();
+                        if (r < 0) {
                                 *ret_error_message = "Failed to disable new privileges";
-                                return log_struct_errno(LOG_EMERG, errno,
+                                return log_struct_errno(LOG_EMERG, r,
                                                         LOG_MESSAGE("Failed to disable new privileges: %m"),
                                                         LOG_MESSAGE_ID(SD_MESSAGE_CORE_DISABLE_PRIVILEGES_STR));
                         }
diff --git a/src/import/import-common.c b/src/import/import-common.c
index 41e945f1fb7..0168311204c 100644
--- a/src/import/import-common.c
+++ b/src/import/import-common.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <sched.h>
-#include <sys/prctl.h>
 #include <unistd.h>
 
 #include "sd-event.h"
@@ -81,8 +80,9 @@ int import_fork_tar_x(int tree_fd, int userns_fd, PidRef *ret_pid) {
                 if (r < 0)
                         log_debug_errno(r, "Failed to drop capabilities, ignoring: %m");
 
-                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
-                        log_warning_errno(errno, "Failed to enable PR_SET_NO_NEW_PRIVS, ignoring: %m");
+                r = proc_set_nnp();
+                if (r < 0)
+                        log_warning_errno(r, "Failed to enable PR_SET_NO_NEW_PRIVS, ignoring: %m");
 
                 if (tar_x(pipefd[0], tree_fd, flags) < 0)
                         _exit(EXIT_FAILURE);
@@ -141,8 +141,9 @@ int import_fork_tar_c(int tree_fd, int userns_fd, PidRef *ret_pid) {
                 if (r < 0)
                         log_debug_errno(r, "Failed to drop capabilities, ignoring: %m");
 
-                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
-                        log_warning_errno(errno, "Failed to enable PR_SET_NO_NEW_PRIVS, ignoring: %m");
+                r = proc_set_nnp();
+                if (r < 0)
+                        log_warning_errno(r, "Failed to enable PR_SET_NO_NEW_PRIVS, ignoring: %m");
 
                 if (tar_c(tree_fd, pipefd[1], /* filename= */ NULL, flags) < 0)
                         _exit(EXIT_FAILURE);
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index f4d85c0418d..13d54364157 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -3593,9 +3593,11 @@ static int inner_child(
         if (r < 0)
                 return log_error_errno(r, "Dropping capabilities failed: %m");
 
-        if (arg_no_new_privileges)
-                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
-                        return log_error_errno(errno, "Failed to disable new privileges: %m");
+        if (arg_no_new_privileges) {
+                r = proc_set_nnp();
+                if (r < 0)
+                        return log_error_errno(r, "Failed to disable new privileges: %m");
+        }
 
         /* LXC sets container=lxc, so follow the scheme here */
         envp[n_env++] = strjoina("container=", arg_container_service_name);