[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <ykmy97joESH91bCHsZwXrM1OS3YcckmX8UcuxUQ6ogsxZjKI9lox0cTS-HuVaVUgn7fcmBdjRV4kdvZU3X5J6j8Ro1OJKzl1DHnka9f6g-M=@hexsys.org>
Date: Mon, 20 May 2024 09:42:38 +0000
From: Ali Polatel <alip@...sys.org>
To: oss-security@...ts.openwall.com
Subject: Article: State of Sandboxing in Linux
Hello list,
I want to share an article I wrote on Linux Sandboxing:
https://git.sr.ht/~alip/syd/tree/main/item/doc/toctou-or-gtfo.md
There's nothing new in there except something I discovered on Landlock which may be a bug or a feature.
TL;DR Landlock allows you to chdir into a directory that's not allowlisted. That's it though, you can
not list/read anything in there so I'd not say this is anything more than a potential info leak (as in
you discovered the dir existed). That said, I am not quite sure.
Very small PoC for those who do no want to read the article:
(-plib turns all seccomp sandboxing off so we apply a very simple landlock sandbox
only allowing /usr, busybox is static linked)
⇒ syd -plib -msandbox/lock:on -m allow/lock/read+/lib -m allow/lock/read+/usr busybox sh
~/src/syd/syd-3 $ cd /tmp
/tmp $ busybox ls
ls: can't open '.': Permission denied
/tmp $
I could enter /tmp although that's not allowlisted by Landlock.
Best regards,
Ali Polatel
PS: Initially I've sent this e-mail using the wrong e-mail address (was not subscribed
to the list), so this is a resend. I apologize if you end up receiving it twice.
Download attachment "publickey - alip@...sys.org - 0xC22DA9DE.asc" of type "application/pgp-keys" (637 bytes)
Download attachment "signature.asc" of type "application/pgp-signature" (250 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
