Description

The kernel has the "nonewprivs" flag, which can be enabled with the NoNewPrivs option of systemd during boot. This option allows you to prevent privilege escalation in any process when this behavior is undesirable. After the flag is set, it persists across execve, clone and fork syscalls, and cannot be cleared. This can help to avoid exploitation of vulnerable software, since the attacker will be running as an ordinary user.

Practical this means: setuid/setgid binaries will stop working.

Currently there is a PoC with openSUSE MicroOS as container host, including rootless podman container.

Goals

The goal is to enhance this to a full Desktop machine:

• test with KDE, document what's not working and try to solve that.
• test with GNOME, document what's not working and try to solve that <= GNOME user needed for this!
• test with k3s
• test with k8s
• create list of setuid/setgid services in Tumbleweed and find ideas to get rid of them.

Resources

• openSUSE MicroOS for container
• openSUSE Tumbleweed for Desktop
• https://build.opensuse.org/project/show/home:kukuk:nonewprivs