SETPRIV(1) SETPRIV(1) setpriv - setpriv [] ] execve(2). su(1) runuser(1) setpriv PAM . set-user-ID execve(2) setuidgid(8) daemontools chpst(8) runit . --clear-groups . -d --dump . . . --groups group... . GID . --inh-caps (+|-)cap..., --ambient-caps (+|-)cap..., --bounding-set (+|-)cap... . capabilities(7). +cap -cap . cap capabilities(7) cap_ cap_N . +all -all . --inh-caps --ambient-caps --bounding-set. ( capabilities(7)) : o . o . o setpriv . . . --keep-groups . --rgid --egid --regid. --init-groups initgroups3. --ruid --reuid. --list-caps . . --nnp, --no-new-privs no_new_privs. execve(2) . set-user-ID set-group-ID . ( . LSM AppArmor .) . prctl(2) Documentation/prctl/no_new_privs.txt . no_new_privs 3.5. --rgid gid --egid gid --regid gid (GIDs) . gid . --clear-groups --groups --keep-groups --init-groups (gid) . --ruid uid --euid uid --reuid uid (UIDs) . uid . uid gid exec . (root) : setpriv --reuid=1000 --regid=1000 --inh-caps=-all --securebits (+|-)securebit... (securebits) . . noroot noroot_locked no_setuid_fixup no_setuid_fixup_locked keep_caps_locked. keep_caps execve(2) . --pdeathsig keep|clear|<> . (LSMs) SELinux AppArmor . --pdeathsig keep . --ptracer -|any|none ptrace Yama ( /proc/sys/kernel/yama/ptrace_scope 1) ptrace(2) PID . PR_SET_PTRACER(2const). ( execve(2).) Yama ptrace . --selinux-label SELinux ( exec dyntrans). setpriv SELinux execve(2) SELinux. ( no_new_privs). runcon(1). --apparmor-profile AppArmor ( exec). setpriv AppArmor execve(2) AppArmor. --landlock-access landlock . --landlock-rule. : setpriv --landlock-access fs : setpriv --landlock-access fs:remove-file,make-dir setpriv --help. "fs" . --landlock-rule --landlock-access. : --landlock-rule $ruletype:$access:$rulearg /boot: --landlock-rule path-beneath:read-file:/boot --seccomp-filter BPF seccomp . enosys. --reset-env o TERM o HOME SHELL USER LOGNAME passwd o SHELL /bin/sh passwd . o PATH /etc/login.defs ( ENV_PATH ENV_SUPATH ENV_ROOTPATH) /usr/local/bin:/bin:/usr/bin /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin . PATH /bin /sbin /usr. -h --help . -V --version . setpriv 127. -- . no_new_privs SELinux ( ) SELinux . su(1)/runuser(1) sudo(8) ( -g) : setpriv --reuid=1000 --regid=1000 --init-groups setuid(8) daemontools : setpriv --reuid=1000 --regid=1000 --clear-groups Andy Lutomirski runuser(1) su(1) prctl(2) capabilities(7) landlock(7) . setpriv util-linux . util-linux 2.42.1 2026-05-18 SETPRIV(1)