Russell Coker: Dirty Clone and SE Linux

There is a new Linux kernel exploit out named Dirty Clone [1]. The first thing to do to exploit this is to create a container with a separate network namespace via one of the following commands: unshare -Urn bwrap –bind / / –unshare-user –unshare-net –uid 0 –gid 0 /bin/bash The Jfrog people recommend “unshare -Urn” but I gave the Bubblewrap command as an option as it should work equally well and in some situations may be permitted when unshare isn’t.…

Quelle: Originalartikel öffnen