[HN Gopher] OSS-SEC: Three bypasses of Ubuntu's unprivileged use...
       ___________________________________________________________________
        
       OSS-SEC: Three bypasses of Ubuntu's unprivileged user namespace
       restrictions
        
       Author : birdculture
       Score  : 32 points
       Date   : 2025-03-29 19:07 UTC (3 hours ago)
        
 (HTM) web link (seclists.org)
 (TXT) w3m dump (seclists.org)
        
       | mjevans wrote:
       | So, entirely, AppArmor profiles for shipped executables allow
       | escape from privileged environments...
       | 
       | Without that additional AppArmor 'blessing', wouldn't the
       | standard Linux privileges / container groups prevent this?
        
         | bri3d wrote:
         | No; note the last sentence in the article:
         | 
         | "a bypass is not even needed on most Linux distributions,
         | because they allow unprivileged users to obtain full
         | capabilities inside namespaces by default (and therefore to
         | exploit CAP_SYS_ADMIN kernel vulnerabilities for example),
         | without any restriction at all."
         | 
         | From the kernel standpoint, without a rules engine (AppArmor,
         | seccomp, SELinux), unprivileged user namespaces are an all-or-
         | nothing thing (unprivileged_userns_clone), so distributions
         | have to rely on complex and leaky rules engines to try to allow
         | namespace segmentation without letting users touch the big,
         | broken kernel too much.
        
       | o11c wrote:
       | Important caveat: this is not itself a vulnerability; you still
       | need a kernel `CAP_SYS_ADMIN` vulnerability if you want to
       | actually do something evil.
       | 
       | (I also expect that if you're already in a restricted AA profile
       | it's not easy to switch to a less-restrictive one, but I think a
       | lot of security tools are bad at thinking about multi-process
       | interpreters)
        
       | j45 wrote:
       | With the Linux kernel references is this only a Ubuntu issue, or
       | could Debian also be affected?
        
       ___________________________________________________________________
       (page generated 2025-03-29 23:00 UTC)