Repository: moby/moby (language: go)

Issue:
Security Options not getting update if no-new-privileges is enabled in /etc/docker/daemon.json
### Description

If we enable `"no-new-privileges" : true` in `/etc/docker/daemon.json`. Security Options are not getting updated even after docker restart. `docker info` is not showing whether no-new-privileges is enabled or not.  Also if we try to inspect individual docker container `SecurityOpt` field is null.
 
Also, if i spawn a container using docker-run and pass --security-opt=no-new-privileges, then docker container SecurityOpts is getting update (non-null value)


```
docker info
...
 Security Options:
  apparmor
  seccomp
   Profile: default
...
```

```
docker inspect <container-id> | grep Security

Output:
            "SecurityOpt": null,
```

Following is the content of daemon.json

```
{
 "iptables": true,
 "log-opts": {"max-size": "200m", "max-file": "1"},
 "log-level": "info" ,
 "live-restore": true,
 "no-new-privileges": true
}```



### Reproduce

1. Add `"no-new-privileges" : true` in /etc/docker/daemon.json
2. Restart docker daemon `systemctl restart docker.service` 
3. `docker info` or inspect any of the running containers.

### Expected behavior

Security Options should get updated with no-new-privileges.

### docker version

```bash
Client: Docker Engine - Community
 Version:           20.10.14
 API version:       1.41
 Go version:        go1.18.8
 Git commit:        a224086
 Built:             Fri Mar 10 06:34:07 2023
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.14
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.8
  Git commit:       87a90dc
  Built:            Fri Mar 10 06:34:43 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.8
  GitCommit:        9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
 runc:
  Version:          1.1.4
  GitCommit:        
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
```


### docker info

```bash
Client:
 Context:    default
 Debug Mode: false

Server:
 Containers: 1
  Running: 1
  Paused: 0
  Stopped: 0
 Images: 1
 Server Version: 20.10.14
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
 runc version: 
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: default
 Kernel Version: 4.19.272-5.ph3
 Operating System: VMware Photon OS/Linux
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 7.79GiB
 Name: dev
 ID: IHGB:CS7S:TBII:XS4W:Q42N:YDUL:ZGDW:IETH:3WZG:Q6NG:ASMS:AKBC
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: true
 Product License: Community Engine
```


### Additional Info

_No response_


Discussion / hints:

Fix patch:
diff --git a/api/swagger.yaml b/api/swagger.yaml
index e8c7c383df7d2..aea752178685a 100644
--- a/api/swagger.yaml
+++ b/api/swagger.yaml
@@ -5243,7 +5243,8 @@ definitions:
       SecurityOptions:
         description: |
           List of security features that are enabled on the daemon, such as
-          apparmor, seccomp, SELinux, user-namespaces (userns), and rootless.
+          apparmor, seccomp, SELinux, user-namespaces (userns), rootless and
+          no-new-privileges.
 
           Additional configuration options for each security feature may
           be present, and are included as a comma-separated list of key/value
diff --git a/daemon/info.go b/daemon/info.go
index 26c5851a50c15..607f685dd59aa 100644
--- a/daemon/info.go
+++ b/daemon/info.go
@@ -170,6 +170,9 @@ func (daemon *Daemon) fillSecurityOptions(v *types.Info, sysInfo *sysinfo.SysInf
 	if daemon.cgroupNamespacesEnabled(sysInfo) {
 		securityOptions = append(securityOptions, "name=cgroupns")
 	}
+	if daemon.noNewPrivileges() {
+		securityOptions = append(securityOptions, "name=no-new-privileges")
+	}
 
 	v.SecurityOptions = securityOptions
 }
diff --git a/daemon/info_unix.go b/daemon/info_unix.go
index f8474191d18b3..e48a81088c5f1 100644
--- a/daemon/info_unix.go
+++ b/daemon/info_unix.go
@@ -366,3 +366,7 @@ func (daemon *Daemon) cgroupNamespacesEnabled(sysInfo *sysinfo.SysInfo) bool {
 func (daemon *Daemon) Rootless() bool {
 	return daemon.configStore.Rootless
 }
+
+func (daemon *Daemon) noNewPrivileges() bool {
+	return daemon.configStore.NoNewPrivileges
+}
diff --git a/daemon/info_windows.go b/daemon/info_windows.go
index 49fb32ce213a4..1e9a696acddd7 100644
--- a/daemon/info_windows.go
+++ b/daemon/info_windows.go
@@ -22,3 +22,7 @@ func (daemon *Daemon) cgroupNamespacesEnabled(sysInfo *sysinfo.SysInfo) bool {
 func (daemon *Daemon) Rootless() bool {
 	return false
 }
+
+func (daemon *Daemon) noNewPrivileges() bool {
+	return false
+}
diff --git a/docs/api/version-history.md b/docs/api/version-history.md
index 70553c27c19d6..c48697245e62d 100644
--- a/docs/api/version-history.md
+++ b/docs/api/version-history.md
@@ -23,6 +23,9 @@ keywords: "API, Docker, rcli, REST, documentation"
 * `GET /images/json` no longer includes hardcoded `<none>:<none>` and
   `<none>@<none>` in `RepoTags` and`RepoDigests` for untagged images.
   In such cases, empty arrays will be produced instead.
+* `GET /info` now includes `no-new-privileges` in the `SecurityOptions` string
+  list when this option is enabled globally. This change is not versioned, and
+  affects all API versions if the daemon has this patch.
 
 ## v1.42 API changes
 


Test patch: