Sample Header Ad - 728x90

Sudo doesnt work in my C wrapper

2 votes
2 answers
104 views
I’m trying to write a C wrapper to run a bash process. The goal of this wrapper is to apply a seccomp policy to restrict certain syscalls. Here is the code:
#define _GNU_SOURCE
#include 
#include 
#include 
#include 
#include 
#include 
#include 

// Function to apply seccomp filter
void apply_seccomp_filter() {
    scmp_filter_ctx ctx;

    // Initialize seccomp context with default allow policy
    ctx = seccomp_init(SCMP_ACT_ALLOW);
    if (ctx == NULL) {
        perror("seccomp_init");
        exit(EXIT_FAILURE);
    }

    // Block finit_module syscall
    if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(finit_module), 0) < 0) {
        perror("seccomp_rule_add: finit_module");
        seccomp_release(ctx);
        exit(EXIT_FAILURE);
    }

    // Load the filter
    if (seccomp_load(ctx) < 0) {
        perror("seccomp_load");
        seccomp_release(ctx);
        exit(EXIT_FAILURE);
    }

    seccomp_release(ctx);
}

int main() {
    apply_seccomp_filter();
    execl("/bin/bash", "bash", NULL);
    perror("execl");
    return EXIT_FAILURE;
}
The code works fine to block the syscall, but when I try to run sudo, I get this message:
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.
Do you know how to disable this flag? All the answers I find online are related to containers like Docker, but that’s not my case. Thanks in advance for your help!
Asked by Liric Ramer (85 rep)
Jun 16, 2025, 03:07 PM
Last activity: Jun 17, 2025, 10:08 AM