Date: Sun, 8 Jan 2017 10:23:51 -0500 From: Brad Spengler <spender@...ecurity.net> To: oss-security@...ts.openwall.com Subject: Re: Re: Firejail local root exploit > $ ./foo > exit code 2 You're missing an important part here: checking to see whether your binary is running with privilege in the first place. If you had done that, you would see that it's not running suid at all, but rather with your own privilege. This is enforced at the kernel level with the following code in kernel/seccomp.c present since the introduction of seccomp-bpf in 2012: /* * Installing a seccomp filter requires that the task has * CAP_SYS_ADMIN in its namespace or be running with no_new_privs. * This avoids scenarios where unprivileged tasks can affect the * behavior of privileged children. */ if (!task_no_new_privs(current) && security_capable_noaudit(current_cred(), current_user_ns(), CAP_SYS_ADMIN) != 0) return ERR_PTR(-EACCES); libseccomp by default enables NNP when creating a filter, as otherwise the code allows you to skip syscalls while still setting the return value to 0, which no suid binary would be able to protect iself against. Prior discussion of this can be found here: https://sourceforge.net/p/libseccomp/mailman/message/29127662/ https://sourceforge.net/p/libseccomp/mailman/message/29136181/ Nothing to see here, but thanks for scaring everyone on a Sunday morning. -Brad [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ