[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20240520120909.GA8629@openwall.com>
Date: Mon, 20 May 2024 14:09:09 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Article: State of Sandboxing in Linux
Hi,
On Mon, May 20, 2024 at 09:42:38AM +0000, Ali Polatel wrote:
> I want to share an article I wrote on Linux Sandboxing:
> https://git.sr.ht/~alip/syd/tree/main/item/doc/toctou-or-gtfo.md
Thanks. I've attached the .md source to this message for archival and
for possible inline quoting in replies. In general, on this list we
strongly prefer content to be included in messages, not only via links
(but relevant links such as the above are desirable to include as well).
> There's nothing new in there except something I discovered on Landlock which may be a bug or a feature.
> TL;DR Landlock allows you to chdir into a directory that's not allowlisted. That's it though, you can
> not list/read anything in there so I'd not say this is anything more than a potential info leak (as in
> you discovered the dir existed). That said, I am not quite sure.
>
>
> Very small PoC for those who do no want to read the article:
> (-plib turns all seccomp sandboxing off so we apply a very simple landlock sandbox
> only allowing /usr, busybox is static linked)
>
>
> ⇒ syd -plib -msandbox/lock:on -m allow/lock/read+/lib -m allow/lock/read+/usr busybox sh
> ~/src/syd/syd-3 $ cd /tmp
> /tmp $ busybox ls
> ls: can't open '.': Permission denied
> /tmp $
>
>
> I could enter /tmp although that's not allowlisted by Landlock.
>
>
> Best regards,
> Ali Polatel
Alexander
View attachment "toctou-or-gtfo.md" of type "text/plain" (45478 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
