cmd/fsu/main.go

@@ -15,8 +15,6 @@ const (
 	fsuConfFile = "/etc/fsurc"
 	envShim     = "FORTIFY_SHIM"
 	envAID      = "FORTIFY_APP_ID"
-
-	PR_SET_NO_NEW_PRIVS = 0x26
 )
 
 var Fmain = compPoison
@@ -88,9 +86,6 @@ func main() {
 	if err := syscall.Setresuid(uid, uid, uid); err != nil {
 		log.Fatalf("cannot set uid: %v", err)
 	}
-	if _, _, errno := syscall.AllThreadsSyscall(syscall.SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0); errno != 0 {
-		log.Fatalf("cannot set no_new_privs flag: %s", errno.Error())
-	}
 	if err := syscall.Exec(fmain, []string{"fortify", "shim"}, []string{envShim + "=" + shimSetupPath}); err != nil {
 		log.Fatalf("cannot start shim: %v", err)
 	}

internal/app/config.go

@@ -55,7 +55,7 @@ type SandboxConfig struct {
 	// do not run in new session
 	NoNewSession bool `json:"no_new_session,omitempty"`
 	// map target user uid to privileged user uid in the user namespace
-	MapRealUID bool `json:"map_real_uid"`
+	UseRealUID bool `json:"use_real_uid"`
 	// mediated access to wayland socket
 	Wayland bool `json:"wayland,omitempty"`
 
@@ -92,7 +92,7 @@ func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error) {
 	}
 
 	var uid int
-	if !s.MapRealUID {
+	if !s.UseRealUID {
 		uid = 65534
 	} else {
 		uid = os.Geteuid()
@@ -185,7 +185,7 @@ func Template() *Config {
 				UserNS:       true,
 				Net:          true,
 				NoNewSession: true,
-				MapRealUID:   true,
+				UseRealUID:   true,
 				Dev:          true,
 				Wayland:      false,
 				// example API credentials pulled from Google Chrome

nixos.nix

@@ -130,7 +130,7 @@ in
                       Whether to allow userns within sandbox.
                     '';
 
-                    mapRealUid = mkEnableOption ''
+                    useRealUid = mkEnableOption ''
                       Whether to map to fortify's real UID within the sandbox.
                     '';
 
@@ -330,7 +330,7 @@ in
                           dev
                           env
                           ;
-                        map_real_uid = launcher.mapRealUid;
+                        use_real_uid = launcher.useRealUid;
                         filesystem =
                           [
                             { src = "/bin"; }