CME-707

NoNewPrivileges

Isolate OS/Kernel Unquantified evidence Preventive

Description

Sets the no_new_privs process flag, preventing any child process from gaining new privileges via execve (SUID bits, file capabilities, setuid transitions). Inherited across fork/exec.

CVSS Vector Impacts

Metric	Transition	Rationale
Privileges Required (PR)	L → H	Cannot use SUID binaries or file capabilities to escalate

CWE Relationships

CWE-269 CWE-250

Verification

Check NoNewPrivs flag on process

$ grep NoNewPrivs /proc/<pid>/status
# Expected: NoNewPrivs: 1

Platform: linux

$ systemctl show <service> -p NoNewPrivileges
# Expected: NoNewPrivileges=yes

Platform: linux

$ kubectl get pod <pod> -n <namespace> -o jsonpath='{.spec.containers[0].securityContext.allowPrivilegeEscalation}'
# Expected: false

Platform: kubernetes

$ grep -r 'NoNewPrivileges=yes' /etc/systemd/system/*.service /etc/systemd/system/*.service.d/ 2>/dev/null | wc -l
# Expected: >=1

Platform: linux

Remediation

linux systemd drop-in with NoNewPrivileges=yes


mkdir -p /etc/systemd/system/<service>.service.d
printf '[Service]\nNoNewPrivileges=yes\n' > /etc/systemd/system/<service>.service.d/no-new-privileges.conf
systemctl daemon-reload
systemctl restart <service>