Set PR_SET_NO_NEW_PRIVS

This means no process in the app can gain any kind of extra
privs during exec() (for instance setuid of file caps).

xdg-app-helper.c

@@ -1150,6 +1150,10 @@ main (int argc,
   /* Get the capabilities we need, drop root */
   acquire_caps ();
 
+  /* Never gain any more privs during exec */
+  if (prctl (PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
+    die_with_error ("prctl(PR_SET_NO_NEW_CAPS) failed");
+
   args = &argv[1];
   n_args = argc - 1;