Merge pull request #6763 from kinvolk/iaguis/no-new-privs

core: allow using seccomp without no_new_privs when unprivileged

test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+[Unit]
+Description=Test bounding set is right with SystemCallFilter and non-root user
+
+[Service]
+ExecStart=/bin/sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_net_bind_service"'
+Type=oneshot
+User=1
+SystemCallFilter=@system-service
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE

test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+[Unit]
+Description=Test bounding set is right with SystemCallFilter and non-root user
+
+[Service]
+ExecStart=/bin/sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_setpcap,cap_net_bind_service,cap_sys_admin"'
+Type=oneshot
+User=1
+SystemCallFilter=@system-service
+CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SETPCAP CAP_NET_BIND_SERVICE

test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service

@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+[Unit]
+Description=Test no_new_privs is unset for ProtectClock and non-root user
+
+[Service]
+ExecStart=/bin/sh -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
+Type=oneshot
+User=1
+ProtectClock=yes

test/test-execute/exec-systemcallfilter-nonewprivileges.service

@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+[Unit]
+Description=Test no_new_privs is unset for SystemCallFilter and non-root user
+
+[Service]
+ExecStart=/bin/sh -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
+Type=oneshot
+User=1
+SystemCallFilter=@system-service