PR_SET_NO_NEW_PRIVS(2const)

💖 PR_SET_NO_NEW_PRIVS — bestie's guide to the vibe-locking privilege switch 💖

okay so this is a page from the prctl(2) family, and it lives in the land of "let me lock my own vibes in place forever." Welcome to it. 🌸

---

✨ NAME ✨

PR_SET_NO_NEW_PRIVS — sets the calling thread's no_new_privs attribute. That's it, that's the whole job, and it does it permanently. 👑

---

📚 LIBRARY 📚

Standard C library — that's libc, a.k.a. -lc. The classics. 💅

---

🫶 SYNOPSIS 🫶

#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>

int prctl(PR_SET_NO_NEW_PRIVS, 1L, 0L, 0L, 0L);

look at that. Notice how the second argument is literally just 1L. That's not a coincidence, that's the whole plot. 🎀

---

🌈 DESCRIPTION 🌈

So you're setting the calling thread's no_new_privs attribute. Cute. Here's the tea: once no_new_privs is set to 1, execve(2) makes a promise — it won't grant you privileges to do anything that couldn't already have been done without that execve(2) call. Which honestly? Iconic behavior.

What does that promise actually kill, you ask? Things like the set-user-ID and set-group-ID mode bits, and file capabilities — all rendered non-functional. 💀 Yeah. They just stop working for you. That's the point.

and here's the part that lowkey changes your whole life: once no_new_privs is set, it cannot be unset. There is no undo. No take-backs. No "wait bestie let me reconsider." 🚨

The setting of this attribute gets inherited by children created by fork(2) and clone(2), and it's preserved across execve(2). So it travels with you. It's a lifestyle. 🦋

---

⭐ RETURN VALUE ⭐

• On success, 0 is returned. slay.
• On error, -1 is returned, and errno is set to indicate the error. 😭

---

💀 ERRORS 💀

• EINVAL — the second argument is not equal to 1L. Like, read the room. It has to be 1L. Nothing else. Not 1, not 2, not a vibe. 1L. periodt. ✨

---

🍓 FILES 🍓

• /proc/pid/status — since Linux 4.10, you can peek at a thread's no_new_privs attribute by looking at the NoNewPrivs field in this file. Stalker mode: activated. 👀

---

👑 STANDARDS 👑

Linux. That's the standard. Just Linux. 🐧

---

🕰️ HISTORY 🕰️

Linux 3.5. A classic from the archives. Old enough to be iconic, young enough to still be relevant. 💜

---

🔥 SEE ALSO 🔥

prctl(2), PR_GET_NO_NEW_PRIVS(2const), seccomp(2)

(yeah PR_GET_NO_NEW_PRIVS exists, so you can read it back — you just can't flip it off. iykyk 💅)

For more info, go read the kernel source file Documentation/userspace-api/no_new_privs.rst. Go on, it's right there.

---

omg and for the receipts: this whole thing is from Linux man-pages 6.20, dated 2026-02-08, and it's the PR_SET_NO_NEW_PRIVS(2const) page. stay safe out there, and remember — you can set it, but you can never set it back. 🎀✨🫶