diff options
Diffstat (limited to 'configd/src/apps/sentinel/platform-specific.h')
-rw-r--r-- | configd/src/apps/sentinel/platform-specific.h | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/configd/src/apps/sentinel/platform-specific.h b/configd/src/apps/sentinel/platform-specific.h new file mode 100644 index 00000000000..d68d5f73768 --- /dev/null +++ b/configd/src/apps/sentinel/platform-specific.h @@ -0,0 +1,16 @@ +// Copyright Vespa.ai. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. +#pragma once + +namespace config::platform_specific { + +/** + * If running on Linux, sets the `no_new_privs` process bit, which amongst other + * things prevents all launched sub-process(es) from acquiring more privileges + * through setuid/setgid executables. + * + * Only takes effect if the `VESPA_PR_SET_NO_NEW_PRIVS` environment variable is + * set to "true" or "yes". + */ +void pledge_no_new_privileges_if_env_configured(); + +} |