Collaborate Disseminate
I have set up an Apparmor custom profile which contains
the deny capability,
This should deny any capability to the application. However,the deny capability is not being enforced. Instead, we have to explicitly deny a specific capability l… Continue reading Apparmor deny capability not being properly enforced
I have created a pod whose container has the SYS_PTRACE capability (and the SYS_ADMIN)
When I am attempting to attach to another process,
gdb -p 12345
Attaching to process 12345
ptrace: Permission denied.
Why is that?
Continue reading ptrace: Permission denied with SYS_PTRACE capability
I have created a kubernetes pod. The container has the SYS_ADMIN capability.
I can see all host’s processes.
However I can not cat /proc/1/environ.
Why is that?
Continue reading Unable to vew /proc/1/environ despite having SYS_ADMIN capability
I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain.
I am in a VM (Kali).
❯ uname -a
Linux cactus-ths 5.18.0-kali5-amd64 #1 SMP … Continue reading Explanation of capabilities: CAP_NET_BIND_SERVICE
I am doing some security research on Kubernetes and I found something still mysterious to me, concerning capabilities.
Example of simple pod:
apiVersion: v1
kind: Pod
metadata:
name: my-pod-httpd
spec:
containers:
– name: my-pod-http… Continue reading Capabilities DROP in container of Kubernetes pod running with specific UID
I have read that there are some capabilities that are broken out of CAP_SYS_ADMIN specifically CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON etc. I also read that data structures called maps are used to store data and that other eBPF programs can re… Continue reading How to keep data in eBPF maps secure
I saw the recent CVE-2022-0492 that can enable container escape, and I have a decent understanding of cgroups and container capabilities, but not very familiar with how hybrid cgroup v1/v2 works, nor how cgroups and capabilities work toget… Continue reading Container escape – CVE-2022-0492 – hybrid cgroups?
From this answer I understand that seccomp-bpf filters the list of syscalls a process can call.
Similarly, the capabilites mechanism will cause a syscall to fail if the caller does not have the capability necessary for that syscall.
What I… Continue reading What additional protection does seccomp provide when compared to capabilites?
I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin’s IP address is IPv6, rather than if its IPv4:
For example, since I configured my smartphone Access Poi… Continue reading Are IPv4 more intuitively hard to track than IPv6?
Under Ubuntu 16.04 LTS, I cannot seem to debug a once-privileged process for love or money as an unprivileged user.
The file is setgid (mode 2755). It forks, and the child:
releases its capabilities
calls setgid(getgid())
Yet, gd… Continue reading attach with gdb after dropping privileges