Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 8 Jan 2017 10:23:51 -0500
From: Brad Spengler <spender@...ecurity.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Firejail local root exploit

> $ ./foo 
> exit code 2

You're missing an important part here: checking to see whether your binary is running
with privilege in the first place.  If you had done that, you would see that it's
not running suid at all, but rather with your own privilege.  This is enforced at the
kernel level with the following code in kernel/seccomp.c present since the introduction
of seccomp-bpf in 2012:

        /*
         * Installing a seccomp filter requires that the task has
         * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
         * This avoids scenarios where unprivileged tasks can affect the
         * behavior of privileged children.
         */
        if (!task_no_new_privs(current) &&
            security_capable_noaudit(current_cred(), current_user_ns(),
                                     CAP_SYS_ADMIN) != 0)
                return ERR_PTR(-EACCES);


libseccomp by default enables NNP when creating a filter, as otherwise the code allows
you to skip syscalls while still setting the return value to 0, which no suid binary
would be able to protect iself against.

Prior discussion of this can be found here:
https://sourceforge.net/p/libseccomp/mailman/message/29127662/
https://sourceforge.net/p/libseccomp/mailman/message/29136181/

Nothing to see here, but thanks for scaring everyone on a Sunday morning.

-Brad

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ