4 ms·

I'm not being smug or insulting when I ask this, but are you familiar with SELinux at all, or have you administered any systems? > If you believe that there's

I'm not being smug or insulting when I ask this, but are you familiar with SELinux at all, or have you administered any systems? > If you believe that there's a way to become root, why don't you believe there's a way to become some other non-root user? SELinux maintains it's own set of users that map to unix user. SELinux users have their own roles and capabilities that are very granular. It's frequently configured to make root 'just another user' as much as possible, and remove any access root doesn't need. So if you 'get root' on a properly configured SELinux system, you don't actually 'have root', you just have a user with a user id of 0 but no real access. You can switch to whatever user administers SELinux policies, but you will only be switching in the unix sense, not the SELinux sense, so you won't actually be able to do anything. To do what you are suggesting would require a kernel exploit, but even if you get root you won't have any access to run it. What you suggest simply is not possible barring very specific vulnerabilities being found, which afaik, have not been.

ori_b 4y ago
I'm not being smug or insulting when I ask this, but are you familiar with pledge and unveil at all, or have you written any code? Pledge and unveil maintains it's own set of system calls and allowed paths that a process may access. Pledge contexts have their own system call masks and capabilities that are very granular. It's hard coded to make root 'just another system call maker' and remove any access root doesn't need. The permissions are ratcheted down as the program initializes, so a process typically doesn't even have access to its own configuration, let alone anything important. Once httpd is started, it can't even start listening on a port -- no matter how much root it has. So if you 'get root' on a properly pledged system, you don't actually 'have root', you just have a program with a user id of 0 but no real access to make system calls. You can switch to whatever user you want, but you will only be switching in the unix sense, and not changing the allowed set of system calls and data accesses, so you won't actually be able to do anything. To do what you are suggesting would require a kernel exploit, but even if you get root you won't have any access to run it. What you suggest simply is not possible barring very specific vulnerabilities being found, which afaik, have not been.
- Zurrrrr 4y ago
  Haha, so you can't even answer the question lol. Yeah, it's clear you have no clue about SELinux at all. What is with you and putting so much effort just to argue out of loyalty and emotion when you don't even know the thing you are arguing against, aside from assumptions? Pledge is a goddamn toy and it's hilarious you think otherwise. Pledge isn't going to do ANYTHING to protect, say, a complex database server or any number of third party programs that need all kinds of access, and require being able to make all types of syscalls. You've parroted my own reply back at me, without bothering to comprehend it or realize that it doesn't apply at all in the way you've bastardized it and tried to force it to. You clearly, CLEARLY have no clue at all what you are talking about, and are basically just the OBSD version of a linux zealot stereotype. In short, you're a tool. You clearly need to have the last word due to your ego, so have at it, but I won't waste my time by humoring you further. It's genuinely a shame I can't block you and will still be notified of whatever noise you make next.
  - ori_b 4y ago
    > Pledge is a goddamn toy and it's hilarious you think otherwise. Pledge isn't going to do ANYTHING to protect, say, a complex database server or any number of third party programs that need all kinds of access, and require being able to make all types of syscalls. Here's a program that will run an arbitrary command under the same restrictions as Chrome. Presumably, Chrome counts as a complex third party program. #include <stdio.h> #include <unistd.h> #include <err.h> #define CHROME_MAIN_CONTENT_PLEDGE \ "rpath wpath cpath stdio tmppath dns inet flock " "unix proc prot_exec tty sendfd recvfd exec mcast " "ps drm fattr route getpw vminfo video" int main(int argc, char **argv) { if(argc < 2) errx(1, "usage: %s cmd\n", argv[0]); if(pledge(CHROME_MAIN_CONTENT_PLEDGE, CHROME_MAIN_CONTENT_PLEDGE) == -1) err(1, "pledge"); if(unveil("/var/empty", "r") == -1) err(1, "unveil"); if(unveil(NULL, NULL) == -1) err(1, "unveil"); execv(argv[1], &argv[1]); err(1, "exec"); } compile as: cc -o asroot asroot.c run as: doas ./asroot your-exploit-command What exploit command you do use to break out?
    - 4y ago

ori_b 4y ago

I'm not being smug or insulting when I ask this, but are you familiar with pledge and unveil at all, or have you written any code? Pledge and unveil maintains it's own set of system calls and allowed paths that a process may access. Pledge contexts have their own system call masks and capabilities that are very granular. It's hard coded to make root 'just another system call maker' and remove any access root doesn't need. The permissions are ratcheted down as the program initializes, so a process typically doesn't even have access to its own configuration, let alone anything important. Once httpd is started, it can't even start listening on a port -- no matter how much root it has. So if you 'get root' on a properly pledged system, you don't actually 'have root', you just have a program with a user id of 0 but no real access to make system calls. You can switch to whatever user you want, but you will only be switching in the unix sense, and not changing the allowed set of system calls and data accesses, so you won't actually be able to do anything. To do what you are suggesting would require a kernel exploit, but even if you get root you won't have any access to run it. What you suggest simply is not possible barring very specific vulnerabilities being found, which afaik, have not been.

Zurrrrr 4y ago
Haha, so you can't even answer the question lol. Yeah, it's clear you have no clue about SELinux at all. What is with you and putting so much effort just to argue out of loyalty and emotion when you don't even know the thing you are arguing against, aside from assumptions? Pledge is a goddamn toy and it's hilarious you think otherwise. Pledge isn't going to do ANYTHING to protect, say, a complex database server or any number of third party programs that need all kinds of access, and require being able to make all types of syscalls. You've parroted my own reply back at me, without bothering to comprehend it or realize that it doesn't apply at all in the way you've bastardized it and tried to force it to. You clearly, CLEARLY have no clue at all what you are talking about, and are basically just the OBSD version of a linux zealot stereotype. In short, you're a tool. You clearly need to have the last word due to your ego, so have at it, but I won't waste my time by humoring you further. It's genuinely a shame I can't block you and will still be notified of whatever noise you make next.
- ori_b 4y ago
  > Pledge is a goddamn toy and it's hilarious you think otherwise. Pledge isn't going to do ANYTHING to protect, say, a complex database server or any number of third party programs that need all kinds of access, and require being able to make all types of syscalls. Here's a program that will run an arbitrary command under the same restrictions as Chrome. Presumably, Chrome counts as a complex third party program. #include <stdio.h> #include <unistd.h> #include <err.h> #define CHROME_MAIN_CONTENT_PLEDGE \ "rpath wpath cpath stdio tmppath dns inet flock " "unix proc prot_exec tty sendfd recvfd exec mcast " "ps drm fattr route getpw vminfo video" int main(int argc, char **argv) { if(argc < 2) errx(1, "usage: %s cmd\n", argv[0]); if(pledge(CHROME_MAIN_CONTENT_PLEDGE, CHROME_MAIN_CONTENT_PLEDGE) == -1) err(1, "pledge"); if(unveil("/var/empty", "r") == -1) err(1, "unveil"); if(unveil(NULL, NULL) == -1) err(1, "unveil"); execv(argv[1], &argv[1]); err(1, "exec"); } compile as: cc -o asroot asroot.c run as: doas ./asroot your-exploit-command What exploit command you do use to break out?
  - 4y ago