3 ms·
$ cat > nope.c <<EOF > #include <stdio.h> > void main() { > write(creat("nope.nope"), "oh no\n", 6); > } > EOF $ make nope $ ./fssb -- ./
by __michaelg 10y ago
$ cat > nope.c <<EOF
> #include <stdio.h>
> void main() {
> write(creat("nope.nope"), "oh no\n", 6);
> }
> EOF
$ make nope
$ ./fssb -- ./nope
fssb: child exited with 4
fssb: sandbox directory: /tmp/fssb-2/
$ cat nope.nope
oh no
- __michaelg 10y agoLesson learned: blacklists are catastrophic for security purposes, because you will always miss something. Even if you didn't miss anything, the next kernel release will just add something new that I can exploit.
- adtac 10y agoUgh, I forgot about `creat`. Should be an easy fix though :) Edit: done! FWIW, I agree with the other comment - blacklists might not be the best solution here.