[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 8 Jan 2017 10:23:51 -0500
From: Brad Spengler <spender@...ecurity.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Firejail local root exploit
> $ ./foo
> exit code 2
You're missing an important part here: checking to see whether your binary is running
with privilege in the first place. If you had done that, you would see that it's
not running suid at all, but rather with your own privilege. This is enforced at the
kernel level with the following code in kernel/seccomp.c present since the introduction
of seccomp-bpf in 2012:
/*
* Installing a seccomp filter requires that the task has
* CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
* This avoids scenarios where unprivileged tasks can affect the
* behavior of privileged children.
*/
if (!task_no_new_privs(current) &&
security_capable_noaudit(current_cred(), current_user_ns(),
CAP_SYS_ADMIN) != 0)
return ERR_PTR(-EACCES);
libseccomp by default enables NNP when creating a filter, as otherwise the code allows
you to skip syscalls while still setting the return value to 0, which no suid binary
would be able to protect iself against.
Prior discussion of this can be found here:
https://sourceforge.net/p/libseccomp/mailman/message/29127662/
https://sourceforge.net/p/libseccomp/mailman/message/29136181/
Nothing to see here, but thanks for scaring everyone on a Sunday morning.
-Brad
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
