The NO_NEW_PRIVS flag is used to prevent setuid/setcap binaries from gaining capabilities at runtime. Its a common security tool, as setuid binaries can be vulnerable in ways that local services cannot.
Because of the simplicity of the lxc-user-nic configuration file, the functionality could be easily provided over a Unix domain socket.
A privileged service can listen on a path such as /run/lxc/user-nic.sock and use SO_PEERCRED to determine if the process its communicating with has the proper rights.
Using systemd's socket activation with Accept=yes makes this feature even easier to implement.
Is this something that would be considered for inclusion?
The
NO_NEW_PRIVSflag is used to prevent setuid/setcap binaries from gaining capabilities at runtime. Its a common security tool, as setuid binaries can be vulnerable in ways that local services cannot.Because of the simplicity of the
lxc-user-nicconfiguration file, the functionality could be easily provided over a Unix domain socket.A privileged service can listen on a path such as
/run/lxc/user-nic.sockand useSO_PEERCREDto determine if the process its communicating with has the proper rights.Using systemd's socket activation with
Accept=yesmakes this feature even easier to implement.Is this something that would be considered for inclusion?