playing with "unc" the unprivileged user containers

Introduction


If you are familiar with docker then you are going to love this little hack. UNC is a tool to demonstrate how to launch containers without being root.

Getting the code and compiling it

git clone https://github.com/LK4D4/unc.git
cd unc
mkdir -p gopath/src/
ln -s ../.. gopath/src/unc
export GOPATH=$PWD/gopath
cd gopath/src/unc
go get
go build
cd unet
go build
cd ..
sudo cp unc unet/unet /usr/local/bin/
sudo chmod u+s /usr/local/bin/unet

What is SetUID for?

"unet" is a tool used "unc" that creates veth pairs and assign one of them to container. Root user (via setuid) is needed to be able to assign a network interface for the user container.


Creating some minimal root filesystems

sudo dnf install busybox
# as regular unprivileged user type
mkdir -p roots/busybox1/{bin,sbin,proc,dev,etc}
cp /sbin/busybox roots/busybox1/sbin/
echo "root:x:0:0:root:/root:/bin/bash" > roots/busybox1/etc/passwd
echo "root:x:0:" > roots/busybox1/etc/group
echo "localhost.localdomain" > roots/busybox1/etc/hostname
echo -e "search local\nnameserver 8.8.8.8" > /etc/resolv.conf

let's make another copy of roots/busybox1

cp -a roots/busybox1 roots/busybox2

Running two user containers and connecting them together

as regular user on one terminal type

cd roots/busybox1
PATH=/bin:/sbin:/usr/local/bin/:/usr/local/sbin/ unc ./sbin/busybox sh

and inside the container you can install busybox tools into bin (from sbin/busybox)

/sbin/busybox --install -s /bin/

make sure the Ethernet link is up

ip a
ip link set uv3012 up

replace uv3012 with whatever interface you see


do the same on busybox2 and ping the two containers like this



as you can see we were able to be container's root and anything I run inside the container as root is not actually root but actually my regular user I used to run "unc"

If you run "ls -lh" my files would appear to be root and I can listen on containers port 80 (using nc)

Going further

  • make things configurable using params
  • maybe replace SetUID "unet" let's say with "dbus" message (get me an interface my privileged brother)
  • maybe make "unc" to be executed as root but have "--become=other_user"



Comments

Post a Comment

Popular posts from this blog

How to defuse XZ Backdoor (or alike) in SSH Daemon

XZ Backdoor in SSH Background Someone planted a backdoor in XZ compression, which is believed to affect SSH. More details can be found. Although it was never shipped to production version of any distro. Even if you are using unaffected version I suggest you defuse any similar backdoors. https://www.openwall.com/lists/oss-security/2024/03/29/4 https://news.ycombinator.com/item?id=39865810 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users The Kill Switch The backdoor has a kill switch, it does not activate if it detects that someone is observing it (debugger attached...etc). An easy way to defuse the backdoor is to just define TERM environment variable causing the backdoor to think it's being observed and it would disable itself hopefully this is not specific to this backdoor but any similar one.  mkdir /etc/systemd/system/sshd.service.d/ echo -e "[Service]\nEnvironment=TERM=xt
Read more

creating CSS3 animations

Introduction In the last posts we have shown how to create some animation using CSS3 transitions (to make buttons that animate moving object or to create an animated slider ). Transitions are triggered in Javascript by a timer or by some action handler (eg. "onclick") that apply some change (change left or change CSS class) and the change will be animated. In this post we will show how to create animations, just animations! For example one might need to animate an bouncing arrow next to some button or pulse current tab in menu. How To ? First you create a CSS selector (eg. a class called "bounce" or "animate_me"), then we need to pick a name for your animation let's say "bounce" .bounce { animation-name: bounce; -webkit-animation-name: bounce; -moz-animation-name: bounce; -ms-animation-name: bounce; -o-animation-name: bounce; } and then specify all animation factors you want like animation-duration in seconds iteration-cou
Read more

CSS3 transformation with Rotating gears example

Introduction Given a static image like this one We might apply many kinds of transformations on it using CSS3 "transform" like rotate and scale, skew or any transformation matrix. How to apply it ? You can rotate gear by 120 degrees using the following css .my_class { -webkit-transform:rotate(120deg); -moz-transform:rotate(120deg); -ms-transform:rotate(120deg); -o-transform:rotate(120deg); transform:rotate(120deg); } You may scale to be 50% smaller using a similar sytax: .my_class { -webkit-transform:scale(0.5); -moz-transform:scale(0.5); -ms-transform:scale(0.5); -o-transform:scale(0.5); transform:scale(0.5); } you may also specify different factor for X-axis and Y-axis using scale(X,Y); You may specify two transformations like this .my_class { -webkit-transform:rotate(120deg) scale(0.5); -mox-transform:rotate(120deg) scale(0.5); } Here is an example How to animating it ? we can use "@-moz-keyframes" and "@-web
Read more