docker历史上的第一个漏洞：关于shocker的一切

$ git clone https://github.com/ssst0n3/docker_archive.git$ cd docker_archive/vul/shocker/shocker_docker-v1.0.0-lxc$ docker compose -f docker-compose.yml -f docker-compose.kvm.yml up -d$ ./sshroot@localhost:~# docker versionClient version: 1.0.0Client API version: 1.12Go version (client): go1.2.1Git commit (client): 63fe64cServer version: 1.0.0Server API version: 1.12Go version (server): go1.2.1Git commit (server): 63fe64croot@localhost:~# lxc-start --version1.0.10

root@localhost:~# ./poc.sh + echo 'loading docker image, docker-v1.0.0 cannot pull images from registry v2 anymore.'loading docker image, docker-v1.0.0 cannot pull images from registry v2 anymore.+ docker load+ docker run -ti busybox:1.36.1 grep Cap /proc/1/statusCapInh:0000000000000000CapPrm:00000018984ceeffCapEff:00000018984ceeffCapBnd:00000018984ceeffroot@localhost:~# capsh --decode=00000018984ceeff0x00000018984ceeff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_chroot,cap_sys_ptrace,cap_sys_boot,cap_mknod,cap_lease,cap_setfcap,cap_wake_alarm,cap_block_suspend

struct file_handle {__u32 handle_bytes;int handle_type;/* file identifier */unsigned char f_handle[];};

/*GetFdinode: 欲打开文件的inode numberref: 文件路径，open_by_handle_at 根据挂载点在其所属文件系统下打开文件句柄return: 打开目标文件，返回fd*/func (v Vulnerability) GetFd(inode int, ref string) (fd int, err error) {hostReference, err := syscall.Open(ref, syscall.O_RDONLY, 0)if err != nil {return}defer syscall.Close(hostReference)inodeBytes := make([]byte, 8)// 将 inode 转换为小端序的字节数组binary.LittleEndian.PutUint64(inodeBytes, uint64(inode))handle := unix.NewFileHandle(1, inodeBytes)fd, err = unix.OpenByHandleAt(hostReference, handle, unix.O_RDONLY)if err != nil {return}return}

func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdriver.Driver, error) {...// figure out whether "index=off" option is recognized by the kernel_, err = os.Stat("/sys/module/overlay/parameters/index")switch {case err == nil:indexOff = "index=off,"case os.IsNotExist(err):// old kernel, no index -- do nothingdefault:logger.Warnf("Unable to detect whether overlay kernel module supports index parameter: %s", err)}...}

const LxcTemplate = `...# drop linux capabilities (apply mainly to the user root in the container)lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod net_raw setfcap setpcap sys_admin sys_boot sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config...`

func setupCapabilities(args *DockerInitArgs) error {if args.privileged {return nil}drop := []capability.Cap{capability.CAP_SETPCAP,capability.CAP_SYS_MODULE,capability.CAP_SYS_RAWIO,capability.CAP_SYS_PACCT,capability.CAP_SYS_ADMIN,capability.CAP_SYS_NICE,capability.CAP_SYS_RESOURCE,capability.CAP_SYS_TIME,capability.CAP_SYS_TTY_CONFIG,capability.CAP_MKNOD,capability.CAP_AUDIT_WRITE,capability.CAP_AUDIT_CONTROL,capability.CAP_MAC_OVERRIDE,capability.CAP_MAC_ADMIN,}c, err := capability.NewPid(os.Getpid())if err != nil {return err}c.Unset(capability.CAPS|capability.BOUNDS, drop...)if err := c.Apply(capability.CAPS | capability.BOUNDS); err != nil {return err}return nil}

func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime, error) {    ...-   ed, err := lxc.NewDriver(config.Root, sysInfo.AppArmor)+   ed, err := namespaces.NewDriver()    ...  runtime := &Runtime{        ...        execDriver:     ed,        ...    }    ...}

+func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {+   ...+   container := createContainer(c)+   ...+}...+func createContainer(c *execdriver.Command) *libcontainer.Container {+   container := getDefaultTemplate()+   ...+}

func DropCapabilities(container *libcontainer.Container) error {if drop := getCapabilities(container); len(drop) > 0 {c, err := capability.NewPid(os.Getpid())if err != nil {return err}c.Unset(capability.CAPS|capability.BOUNDS, drop...)if err := c.Apply(capability.CAPS | capability.BOUNDS); err != nil {return err}}return nil}func getCapabilities(container *libcontainer.Container) []capability.Cap {drop := []capability.Cap{}for _, c := range container.Capabilities {drop = append(drop, capMap[c])}return drop}

# drop linux capabilities (apply mainly to the user root in the container)+#  (Note: 'lxc.cap.keep' is coming soon and should replace this under the+#         security principle 'deny all unless explicitly permitted', see+#         http://sourceforge.net/mailarchive/message.php?msg_id=31054627 )lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod setfcap setpcap sys_admin sys_boot sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config

+// DropCapabilities drops all capabilities for the current process expect those specified in the container configuration. func DropCapabilities(container *libcontainer.Container) error {-if drop := getCapabilitiesMask(container); len(drop) > 0 {-c, err := capability.NewPid(os.Getpid())-if err != nil {-return err-}-c.Unset(capability.CAPS|capability.BOUNDS, drop...)+c, err := capability.NewPid(os.Getpid())+if err != nil {+return err+}-if err := c.Apply(capability.CAPS | capability.BOUNDS); err != nil {-return err-}+keep := getEnabledCapabilities(container)+c.Clear(allCapabilityTypes)+c.Set(allCapabilityTypes, keep...)++if err := c.Apply(allCapabilityTypes); err != nil {+return err } return nil }-// getCapabilitiesMask returns the specific cap mask values for the libcontainer types-func getCapabilitiesMask(container *libcontainer.Container) []capability.Cap {-drop := []capability.Cap{}+// getCapabilitiesMask returns the capabilities that should not be dropped by the container.+func getEnabledCapabilities(container *libcontainer.Container) []capability.Cap {+keep := []capability.Cap{} for key, enabled := range container.CapabilitiesMask {-if !enabled {+if enabled { if c := libcontainer.GetCapability(key); c != nil {-drop = append(drop, c.Value)+keep = append(keep, c.Value) } } }-return drop+return keep }

func New() *libcontainer.Container {container := &libcontainer.Container{CapabilitiesMask: map[string]bool{"SETPCAP":        false,..."MKNOD":          true,"SYSLOG":         false,+"SETUID":         true,+"SETGID":         true,+"CHOWN":          true,+"NET_RAW":        true,+"DAC_OVERRIDE":   true,},...}...}

func init() {execdriver.RegisterInitFunc(DriverName, func(args *execdriver.InitArgs) error {...-if err := setupCapabilities(args); err != nil {-return err-}-if err := setupWorkingDirectory(args); err != nil {-return err-}-if err := system.CloseFdsFrom(3); err != nil {-return err-}-if err := changeUser(args); err != nil {-return err-}+if err := finalizeNamespace(args); err != nil {...})}

import (...+"github.com/dotcloud/docker/daemon/execdriver/native/template"...)...+func finalizeNamespace(args *execdriver.InitArgs) error {...+container := template.New()++if !args.Privileged {+// drop capabilities in bounding set before changing user+if err := dropBoundingSet(); err != nil {+return fmt.Errorf("drop bounding set %s", err)+}++// preserve existing capabilities while we change users+if err := system.SetKeepCaps(); err != nil {+return fmt.Errorf("set keep caps %s", err)+}+}...+if !args.Privileged {+if err := system.ClearKeepCaps(); err != nil {+return fmt.Errorf("clear keep caps %s", err)+}++// drop all other capabilities+if err := dropCapabilities(); err != nil {+return fmt.Errorf("drop capabilities %s", err)+}+}...+}