Re: Article: State of Sandboxing in Linux

[Solar Designer <solar () openwall com>]

Hi,

On Mon, May 20, 2024 at 09:42:38AM +0000, Ali Polatel wrote:
> I want to share an article I wrote on Linux Sandboxing:
> https://git.sr.ht/~alip/syd/tree/main/item/doc/toctou-or-gtfo.md

Thanks.  I've attached the .md source to this message for archival and
for possible inline quoting in replies.  In general, on this list we
strongly prefer content to be included in messages, not only via links
(but relevant links such as the above are desirable to include as well).

> There's nothing new in there except something I discovered on Landlock which may be a bug or a feature.
> TL;DR Landlock allows you to chdir into a directory that's not allowlisted. That's it though, you can
> not list/read anything in there so I'd not say this is anything more than a potential info leak (as in
> you discovered the dir existed). That said, I am not quite sure.
>
>
> Very small PoC for those who do no want to read the article:
> (-plib turns all seccomp sandboxing off so we apply a very simple landlock sandbox
> only allowing /usr, busybox is static linked)
>
>
> ⇒ syd -plib -msandbox/lock:on -m allow/lock/read+/lib -m allow/lock/read+/usr busybox sh
> ~/src/syd/syd-3 $ cd /tmp
> /tmp $ busybox ls
> ls: can't open '.': Permission denied
> /tmp $
>
>
> I could enter /tmp although that's not allowlisted by Landlock.
>
>
> Best regards,
> Ali Polatel

Alexander

Attachment: toctou-or-gtfo.md
Description: