[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20190725041914.GA18109@pi3.com.pl>
Date: Thu, 25 Jul 2019 06:19:14 +0200
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Recent container escape and LKRG
Felix Wilhelm recently tweeted a Proof of Concept (PoC) of container escape
abusing release agent for cgroup v1.
https://twitter.com/_fel1x/status/1151487051986087936
To be able to perform the attack, container was run with the "--privileged"
flag which is not a setup for security anyway. When using this flag, containers
have full access to all devices and lack restrictions from seccomp, AppArmor,
and Linux capabilities. Nevertheless, "--privileged" flag is just a
simplification of the necessary requirements for this attack, which is
SYS_ADMIN capability for the container itself, as well as VFS for cgroup v1
mount with the read and write permission.
Felix was able to inject a custom command into the mechanism known as a
"notify_on_release" in cgroup v1. When the last task in a cgroup leaves it, a
release agent is executed by the kernel via call_usermodehelper_exec()
(UserModeHelper - UMH) mechanism. Since the kernel is doing 'clean-up', UMH is
executed on the host outside of the namespace / container.
More information about release_agent can be found here:
https://www.kernel.org/doc/Documentation/cgroup-v1/cgroups.txt
Linux Kernel Runtime Guard (LKRG) has functionality of limiting an UMH
interface. By default, it is allowed to execute only LKRG's whitelisted
programs. For some people it might be not enough and in that case LKRG has an
ability to fully lock UMH and nothing can be executed via this interface. This
might break things if your distro uses UMH to invoke any programs e.g. if you
are using release_agent ;-)
You can see how LKRG can save you by preventing and detecting Felix's container
escape (based on UMH) here:
https://twitter.com/Adam_pi3/status/1153698196104912898
http://blog.pi3.com.pl/?p=663
Thanks,
Adam
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
