ColonelThirtyTwo comments on Omarchy: Any User Process Can Escalate to Root

[–] ColonelThirtyTwo@pawb.social 21 points 1 month ago (4 children)

FWIW this isn't a container escape. It's just the distro shipping a shitty default that lets the users on the host access root.

permalink

fedilink

source

parent

hideshow 4 child comments

[–] NaibofTabr@infosec.pub 2 points 1 month ago (3 children)

On affected Omarchy systems, this means that the default user and all processes launched in that user session have access to root.

Hmm, maybe I'm misunderstanding. Does "all processes launched in that user session" not include containerized apps?

permalink

fedilink

source

parent

hideshow 3 child comments

[–] equivocal@piefed.social 6 points 1 month ago (1 child)

The issue is that the docker service runs as root and their defaults added the user to a group that allows them to control that service without sudo

So, the root filesystem can just be passed as a volume to a container and then do whatever you want from there.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] NaibofTabr@infosec.pub -1 points 1 month ago

OK, so if you can pass the host root filesystem to a container and then write files or execute code with root privileges on that filesystem, I would definitely consider that a container escape. You're executing arbitrary code on the host from within a container.

permalink

fedilink

source

parent

[–] ColonelThirtyTwo@pawb.social 6 points 1 month ago

The issue isn't that the containers have permissions they weren't assigned. It's that the system configuration allows any (host) user to make a container with any permissions, without sudo.

permalink

fedilink

source

parent