drop-privs-harder.c

// cc drop-privs-harder.c -o drop-privs-harder -lseccomp

#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <sys/prctl.h>

#include <errno.h>
#include <seccomp.h>

#include <sched.h>

int main(int argc, char *argv[]) {
    if (argc < 2) {
        fprintf(stderr, "usage: %s other-command [other args...]\n", argv[0]);
        return 1;
    }

    if (-1 == prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
        perror("prctl");
        return 2;
    }

    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW);

    if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(unshare), 1,
                SCMP_A0(SCMP_CMP_MASKED_EQ, CLONE_NEWUSER, CLONE_NEWUSER))) {
        perror("rule add");
        return 3;
    }

    if (seccomp_load(ctx)) {
        perror("load");
        return 4;
    }

    execvp(argv[1], &argv[1]);
    perror("execv");
}