[HN Gopher] OSS-SEC: Three bypasses of Ubuntu's unprivileged use...
___________________________________________________________________
OSS-SEC: Three bypasses of Ubuntu's unprivileged user namespace
restrictions
Author : birdculture
Score : 32 points
Date : 2025-03-29 19:07 UTC (3 hours ago)
(HTM) web link (seclists.org)
(TXT) w3m dump (seclists.org)
| mjevans wrote:
| So, entirely, AppArmor profiles for shipped executables allow
| escape from privileged environments...
|
| Without that additional AppArmor 'blessing', wouldn't the
| standard Linux privileges / container groups prevent this?
| bri3d wrote:
| No; note the last sentence in the article:
|
| "a bypass is not even needed on most Linux distributions,
| because they allow unprivileged users to obtain full
| capabilities inside namespaces by default (and therefore to
| exploit CAP_SYS_ADMIN kernel vulnerabilities for example),
| without any restriction at all."
|
| From the kernel standpoint, without a rules engine (AppArmor,
| seccomp, SELinux), unprivileged user namespaces are an all-or-
| nothing thing (unprivileged_userns_clone), so distributions
| have to rely on complex and leaky rules engines to try to allow
| namespace segmentation without letting users touch the big,
| broken kernel too much.
| o11c wrote:
| Important caveat: this is not itself a vulnerability; you still
| need a kernel `CAP_SYS_ADMIN` vulnerability if you want to
| actually do something evil.
|
| (I also expect that if you're already in a restricted AA profile
| it's not easy to switch to a less-restrictive one, but I think a
| lot of security tools are bad at thinking about multi-process
| interpreters)
| j45 wrote:
| With the Linux kernel references is this only a Ubuntu issue, or
| could Debian also be affected?
___________________________________________________________________
(page generated 2025-03-29 23:00 UTC)