3 ms·

Note that a sandbox escape is often possible via TIOCSTI (CVE-2017-5226) [0] unless a special flag (--new-session) is used. Bubblewrap is aware of this, yet th

Note that a sandbox escape is often possible via TIOCSTI (CVE-2017-5226) [0] unless a special flag (--new-session) is used. Bubblewrap is aware of this, yet their documentation gives no indication that this flag is necessary to produce a secure sandbox. In --help, the documentation of --new-session is simply "Create a new terminal session," which severely understates its importance. It's frustrating to have such a useful tool be knowingly easy to misuse. [0]: https://github.com/containers/bubblewrap/issues/142 https://github.com/containers/bubblewrap/issues/142

jagrsw 5y ago
FWIW, it's disabled in nsjail by default https://github.com/google/nsjail/blob/6483728e2490c1fc497a81bba5682515eb489cf8/config.proto#L130 https://github.com/google/nsjail/blob/6483728e2490c1fc497a81... with relevant comment.
ciupicri 5y ago
By the way, it looks like OpenBSD disabled TIOCSTI [1] [2]. [1]: https://undeadly.org/cgi?action=article;sid=20170701132619 https://undeadly.org/cgi?action=article;sid=20170701132619 [2]: https://marc.info/?l=openbsd-cvs&m=149870941319610 https://marc.info/?l=openbsd-cvs&m=149870941319610