Re: Re: Firejail local root exploit

[Brad Spengler <spender () grsecurity net>]

> $ ./foo 
> exit code 2

You're missing an important part here: checking to see whether your binary is running
with privilege in the first place.  If you had done that, you would see that it's
not running suid at all, but rather with your own privilege.  This is enforced at the
kernel level with the following code in kernel/seccomp.c present since the introduction
of seccomp-bpf in 2012:

        /*
         * Installing a seccomp filter requires that the task has
         * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
         * This avoids scenarios where unprivileged tasks can affect the
         * behavior of privileged children.
         */
        if (!task_no_new_privs(current) &&
            security_capable_noaudit(current_cred(), current_user_ns(),
                                     CAP_SYS_ADMIN) != 0)
                return ERR_PTR(-EACCES);


libseccomp by default enables NNP when creating a filter, as otherwise the code allows
you to skip syscalls while still setting the return value to 0, which no suid binary
would be able to protect iself against.

Prior discussion of this can be found here:
https://sourceforge.net/p/libseccomp/mailman/message/29127662/
https://sourceforge.net/p/libseccomp/mailman/message/29136181/

Nothing to see here, but thanks for scaring everyone on a Sunday morning.

-Brad

Attachment: signature.asc
Description: Digital signature