PRIV_WRAPPER(1)

💅 priv_wrapper — the NAME section ✨

okay so bestie, welcome to the manual page for priv_wrapper, section 1 of the manual, and it's literally a library whose whole job is to disable resource limits and other priviledge dropping. that's the vibe. that's the mission. 🫶

---

🌸 SYNOPSIS 🌸

like, here's how you summon it:

LD_PRELOAD=libpriv_wrapper.so PRIV_WRAPPER=1
[PRIV_WRAPPER_CHROOT_DISABLE=1] [PRIV_WRAPPER_PRCTL_DISABLE=<options>]
[PRIV_WRAPPER_SETRLIMIT_DISABLE=<options>]

the brackets are the optional besties, they can come or not, no pressure 💖

---

🦋 DESCRIPTION 🦋

so priv_wrapper is here to help you run processes that are dropping privileges or restricting resources in test environments. it can disable the chroot, prctl, pledge and setrlmit system calls, no cap.

and here's the iconic part: a disabled call always succeeds — like, it returns 0 — and it does absolutely nothing. it's giving "yes queen, everything went great" while literally doing zero things. 💀

one tiny caveat bestie: the pledge system call exists only on OpenBSD. iykyk. 🧚

---

🎀 ENVIRONMENT VARIABLES 🎀

these are the little switches that make it go. set them in your env and watch the magic.

PRIV_WRAPPER

setting this to 1 is what activates priv_wrapper. that's the on switch bestie, nothing happens without it.

PRIV_WRAPPER_DISABLE_DEEPBIND

this one lets you turn off deep binding inside priv_wrapper. super useful if you're running valgrind tools or sanitizers like (address, undefined, thread) and they're being dramatic about it. 🙈

PRIV_WRAPPER_CHROOT_DISABLE

set this to 1 and the chroot() system call gets disabled. bye bye jail, hello freedom ✨

PRIV_WRAPPER_PRCTL_DISABLE

you can disable prctl calls with this. two ways, pick your fighter:

• disable literally all of them with PRIV_WRAPPER_PRCTL_DISABLE=ALL
• or pick special options, like PRIV_WRAPPER_PRCTL_DISABLE=PR_SET_SECCOMP|PR_SET_NO_NEW_PRIVS

the supported options are:

• PR_SET_SECCOMP
• PR_SET_NO_NEW_PRIVS
• PR_SET_DUMPABLE

PRIV_WRAPPER_SETRLIMIT_DISABLE

same energy, but for resource limits. either go all in with PRIV_WRAPPER_SETRLIMIT_DISABLE=ALL, or pick the specific resources you want gone, like:

PRIV_WRAPPER_SETRLIMIT_DISABLE=RLIMIT_STACK|RLIMIT_CORE

the supported options are:

• RLIMIT_CPU
• RLIMIT_FSIZE
• RLIMIT_DATA
• RLIMIT_STACK
• RLIMIT_CORE
• RLIMIT_RSS
• RLIMIT_NOFILE
• RLIMIT_AS
• RLIMIT_NPROC
• RLIMIT_MEMLOCK
• RLIMIT_LOCKS
• RLIMIT_SIGPENDING
• RLIMIT_MSGQUEUE
• RLIMIT_NICE
• RLIMIT_RTPRIO
• RLIMIT_RTTIME
• RLIMIT_NLIMITS

PRIV_WRAPPER_PLEDGE_DISABLE

set this to 1 and the pledge() system call gets disabled. (remember bestie, pledge is OpenBSD-only 🦋)

PRIV_WRAPPER_DEBUGLEVEL

if you need to see what's going on inside priv_wrapper itself, or you're hunting down a bug, you can enable logging support — that works if you built it with debug symbols. the levels go like this:

• 0 = ERROR
• 1 = WARNING
• 2 = DEBUG
• 3 = TRACE

---

✨ EXAMPLE ✨

here's the main character moment, two whole recipes:

LD_PRELOAD=libpriv_wrapper.so PRIV_WRAPPER=1
PRIV_WRAPPER_PRCTL_DISABLE="PR_SET_SECCOMP|PR_SET_NO_NEW_PRIVS"

LD_PRELOAD=libpriv_wrapper.so PRIV_WRAPPER=1
PRIV_WRAPPER_CHROOT_DISABLE=1 PRIV_WRAPPER_PRCTL_DISABLE=ALL
PRIV_WRAPPER_SETRLIMIT_DISABLE="RLIMIT_CPU|RLIMIT_DATA|RLIMIT_NLIMITS"

copy, paste, slay. 💅

---

👑 AUTHOR 👑

Samba Team — that's the icon, the legend, the moment. periodt. 🫶

---

and that's the whole page bestie!! this one's from the PRIV_WRAPPER(1) manual, section 1, dated 2022-09-14. go forth and disable some privilege dropping, you absolute legend 💖✨🎀