June 2016

Red Hat Security Blog: The Answer is always the same: Layers of Security

いつものSELinuxマンがseccomp disってるだけだった。ざんねん
このエントリーをはてなブックマークに追加

ptraceを無効化してないと、PTRACE_O_SUSPEND_SECCOMP で自由にseccompを無効化できてしまう。
などと書いてある文献を見つけたのでちょっと調査

なお、このコミットだった模様
 
commit 13c4a90119d28cfcb6b5bdd820c233b86c2b0237
Author: Tycho Andersen <tycho.andersen@canonical.com>
Date:   Sat Jun 13 09:02:48 2015 -0600

    seccomp: add ptrace options for suspend/resume

    This patch is the first step in enabling checkpoint/restore of processes
    with seccomp enabled.

    One of the things CRIU does while dumping tasks is inject code into them
    via ptrace to collect information that is only available to the process
    itself. However, if we are in a seccomp mode where these processes are
    prohibited from making these syscalls, then what CRIU does kills the task.

    This patch adds a new ptrace option, PTRACE_O_SUSPEND_SECCOMP, that enables
    a task from the init user namespace which has CAP_SYS_ADMIN and no seccomp
    filters to disable (and re-enable) seccomp filters for another task so that
    they can be successfully dumped (and restored). We restrict the set of
    processes that can disable seccomp through ptrace because although today
    ptrace can be used to bypass seccomp, there is some discussion of closing
    this loophole in the future and we would like this patch to not depend on
    that behavior and be future proofed for when it is removed.

    Note that seccomp can be suspended before any filters are actually
    installed; this behavior is useful on criu restore, so that we can suspend
    seccomp, restore the filters, unmap our restore code from the restored
    process' address space, and then resume the task by detaching and have the
    filters resumed as well.

 

ようするにseccompが有効化されてるコンテナでもCRIUしたいじゃんってことらしい。
えーと、gdbもCRIUも使いたいけど、seccomp迂回は限定したいって時はどうしたら・・・・??



このエントリーをはてなブックマークに追加

↑このページのトップヘ