From 8fb70f87166f41221133201ecb1ca8ee6d7f5b54 Mon Sep 17 00:00:00 2001
From: upodroid <cy@borg.dev>
Date: Thu, 22 Jan 2026 17:08:03 +0300
Subject: [PATCH] add nonewprivs to agnhost

---
 test/images/agnhost/VERSION              |  2 +-
 test/images/agnhost/agnhost.go           |  2 ++
 test/images/agnhost/nonewprivs/OWNERS    |  4 +++
 test/images/agnhost/nonewprivs/README.md |  3 ++
 test/images/agnhost/nonewprivs/main.go   | 37 ++++++++++++++++++++++++
 5 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 test/images/agnhost/nonewprivs/OWNERS
 create mode 100644 test/images/agnhost/nonewprivs/README.md
 create mode 100644 test/images/agnhost/nonewprivs/main.go

diff --git a/test/images/agnhost/VERSION b/test/images/agnhost/VERSION
index 881307c79c6..995366c63c4 100644
--- a/test/images/agnhost/VERSION
+++ b/test/images/agnhost/VERSION
@@ -1 +1 @@
-2.61
+2.62.0
diff --git a/test/images/agnhost/agnhost.go b/test/images/agnhost/agnhost.go
index 5bef6e8b40b..e53d26455ef 100644
--- a/test/images/agnhost/agnhost.go
+++ b/test/images/agnhost/agnhost.go
@@ -42,6 +42,7 @@ import (
 	"k8s.io/kubernetes/test/images/agnhost/nettest"
 	nosnat "k8s.io/kubernetes/test/images/agnhost/no-snat-test"
 	nosnatproxy "k8s.io/kubernetes/test/images/agnhost/no-snat-test-proxy"
+	"k8s.io/kubernetes/test/images/agnhost/nonewprivs"
 	"k8s.io/kubernetes/test/images/agnhost/openidmetadata"
 	"k8s.io/kubernetes/test/images/agnhost/pause"
 	"k8s.io/kubernetes/test/images/agnhost/podcertificatesigner"
@@ -96,6 +97,7 @@ func main() {
 	rootCmd.AddCommand(podcertificatesigner.CmdPodCertificateSigner)
 	rootCmd.AddCommand(mtlsclient.CmdMtlsClient)
 	rootCmd.AddCommand(mtlsserver.CmdMtlsServer)
+	rootCmd.AddCommand(nonewprivs.CmdNoNewPrivs)
 	// NOTE(claudiub): Some tests are passing logging related flags, so we need to be able to
 	// accept them. This will also include them in the printed help.
 	code := cli.Run(rootCmd)
diff --git a/test/images/agnhost/nonewprivs/OWNERS b/test/images/agnhost/nonewprivs/OWNERS
new file mode 100644
index 00000000000..defaa1d056a
--- /dev/null
+++ b/test/images/agnhost/nonewprivs/OWNERS
@@ -0,0 +1,4 @@
+approvers:
+  - mkumatag
+emeritus_approvers:
+  - jessfraz
diff --git a/test/images/agnhost/nonewprivs/README.md b/test/images/agnhost/nonewprivs/README.md
new file mode 100644
index 00000000000..dd027c394bb
--- /dev/null
+++ b/test/images/agnhost/nonewprivs/README.md
@@ -0,0 +1,3 @@
+# nonewprivs
+
+A simple go app that prints the UID of the process running to test security context features.
diff --git a/test/images/agnhost/nonewprivs/main.go b/test/images/agnhost/nonewprivs/main.go
new file mode 100644
index 00000000000..60f8422644c
--- /dev/null
+++ b/test/images/agnhost/nonewprivs/main.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nonewprivs
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+// CmdNoneNewPrivs is used by agnhost Cobra.
+var CmdNoNewPrivs = &cobra.Command{
+	Use:   "nonewprivs",
+	Short: "Prints the UID of the running process",
+	Long:  `A go app that prints the UID of the process running to test security context features`,
+	Args:  cobra.MaximumNArgs(0),
+	Run:   main,
+}
+
+func main(cmd *cobra.Command, args []string) {
+	fmt.Printf("Effective uid: %d\n", os.Geteuid())
+}