Add env var for setting `no_new_privs` process bit on Linux

If set, this will apply to all processes launched by the config
sentinel, directly or transitively. This is a one-way toggle.

See https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt

1 files changed, 16 insertions, 0 deletions

diff --git a/configd/src/apps/sentinel/platform-specific.h b/configd/src/apps/sentinel/platform-specific.h
new file mode 100644
index 00000000000..d68d5f73768
--- /dev/null
+++ b/configd/src/apps/sentinel/platform-specific.h
@@ -0,0 +1,16 @@
+// Copyright Vespa.ai. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+#pragma once
+
+namespace config::platform_specific {
+
+/**
+ * If running on Linux, sets the `no_new_privs` process bit, which amongst other
+ * things prevents all launched sub-process(es) from acquiring more privileges
+ * through setuid/setgid executables.
+ *
+ * Only takes effect if the `VESPA_PR_SET_NO_NEW_PRIVS` environment variable is
+ * set to "true" or "yes".
+ */
+void pledge_no_new_privileges_if_env_configured();
+
+}