Quote https://manpages.debian.org/buster/manpages/ld.so.8.en.html#Secure-execution_mode

Secure-execution mode

For security reasons, the effects of some environment variables are voided or modified if the dynamic linker determines that the binary should be run in secure-execution mode. (For details, see the discussion of individual environment variables below.) A binary is executed in secure-execution mode if the AT_SECURE entry in the auxiliary vector (see getauxval(3)) has a nonzero value. This entry may have a nonzero value for various reasons, including:

  • The process's real and effective user IDs differ, or the real and effective group IDs differ. This typically occurs as a result of executing a set-user-ID or set-group-ID program.
  • A process with a non-root user ID executed a binary that conferred capabilities to the process.
  • A nonzero value may have been set by a Linux Security Module.

How could secure-execution mode be globally enabled lets say for all applications started from a limited linux user account user?

  • Well you could patch the linker to do that, but why would you want to? It's only really useful for setuid/setgid binaries. – forest Jan 3 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.