Throw error if no_new_privs is set

[Quackdoc]

Describe the feature you'd like see implemented in sudo-rs
Sudo-rs has a blanket error that can misreport issues like having no_new_privs set.

What problem can be solved with this feature?
When running in a container, it can be common for no_new_privs to be set and sudors is cryptic when this is the issue

[bjorn3]

We already have a check that our effective uid is root at

sudo-rs/src/sudo/mod.rs

Lines 123 to 130 in 5d2435b

	fn self_check() -> Result<(), Error> {
	let euid = User::effective_uid();
	if euid == UserId::ROOT {
	Ok(())
	} else {
	Err(Error::SelfCheck)
	}
	}

Makes sense to me to detect if no_new_privs is enabled when this error happens and give a more targeted error message for that case. The error message is formatted at:

sudo-rs/src/common/error.rs

Lines 60 to 62 in 5d2435b

	Error::SelfCheck => {
	f.write_str("sudo must be owned by uid 0 and have the setuid bit set")
	}

[Quackdoc]

This doesn't cover the use case of namespaces/containers, for example, using a namespace with seccomp and a uid mask.

In this case, the setuid bit is set and is owned by "uid 0" but sudo-rs will still give this error which is incorrect.

It may be worth just modifying that message to report that no_new_privs could be the issue.

[bjorn3]

It may be worth just modifying that message to report that no_new_privs could be the issue.

We could report a different error message just when no_new_privs is set, right?

[Quackdoc]

Yes that would be ideal. ubuntu's sudo reports

sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the