I’m trying to write a C wrapper to run a bash process. The goal of this wrapper is to apply a seccomp policy to restrict certain syscalls.
Here is the code:
#define _GNU_SOURCE
#include
#include
#include
#include
#include
#include
#include
// Function to apply seccomp filter
void apply_seccomp_filter() {
scmp_filter_ctx ctx;
// Initialize seccomp context with default allow policy
ctx = seccomp_init(SCMP_ACT_ALLOW);
if (ctx == NULL) {
perror("seccomp_init");
exit(EXIT_FAILURE);
}
// Block finit_module syscall
if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(finit_module), 0) < 0) {
perror("seccomp_rule_add: finit_module");
seccomp_release(ctx);
exit(EXIT_FAILURE);
}
// Load the filter
if (seccomp_load(ctx) < 0) {
perror("seccomp_load");
seccomp_release(ctx);
exit(EXIT_FAILURE);
}
seccomp_release(ctx);
}
int main() {
apply_seccomp_filter();
execl("/bin/bash", "bash", NULL);
perror("execl");
return EXIT_FAILURE;
}
The code works fine to block the syscall, but when I try to run sudo, I get this message:
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.
Do you know how to disable this flag? All the answers I find online are related to containers like Docker, but that’s not my case.
Thanks in advance for your help!
Asked by Liric Ramer
(85 rep)
Jun 16, 2025, 03:07 PM
Last activity: Jun 17, 2025, 10:08 AM
Last activity: Jun 17, 2025, 10:08 AM