Setting NoNewPrivs system wide as default
Setuid binaries are not dangerous in themselves, but a rather worthwhile target that can lead to privilege escalation if they have a vulnerability. The goal is therefore to eliminate this attack surface. The kernel provides a solution with the no_new_privs flag, which effectively disables setuid/setgid bits and file capabilities. This flag can be set with systemd and the NoNewPrivs option in Pid1.
In this talk I will present how this can be reached, what the current status is and where are the remaining problems are.