Qhov tsis zoo (CVE-2022-31214) tau raug txheeb xyuas nyob rau hauv Firejail daim ntawv thov kev rho tawm hluav taws xob uas tso cai rau tus neeg siv hauv zos kom tau txais cov cai hauv paus ntawm tus tswv tsev. Muaj kev siv nyiaj txiag ua haujlwm muaj nyob rau hauv pej xeem sau npe, sim hauv kev tshaj tawm tam sim no ntawm openSUSE, Debian, Arch, Gentoo thiab Fedora nrog rau qhov chaw tua hluav taws. Qhov teeb meem yog kho nyob rau hauv firejail 0.9.70 tso tawm. Raws li kev ua haujlwm rau kev tiv thaiv, koj tuaj yeem teeb tsa "tsis koom nrog" thiab "force-nonewprivs yog" tsis nyob hauv qhov chaw (/etc/firejail/firejail.config).
Firejail siv namespaces, AppArmor, thiab system hu filtering (seccomp-bpf) nyob rau hauv Linux rau kev rho tawm, tab sis yuav tsum tau nce cov cai los teeb tsa kev tua cais, uas nws tau txais los ntawm kev khi rau cov nqi hluav taws xob chij suid hauv paus lossis khiav nrog sudo. Qhov tsis zoo yog tshwm sim los ntawm kev ua yuam kev hauv lub logic ntawm "--join = " kev xaiv, npaj rau kev txuas mus rau ib puag ncig uas twb tau khiav lawm (analogous rau tus ID nkag mus rau ib puag ncig sandbox) nrog ib puag ncig raug txiav txim los ntawm txheej txheem ID khiav hauv nws. Thaum lub sij hawm pre-privilege rov pib dua, firejail txiav txim siab cov cai ntawm cov txheej txheem teev tseg thiab siv lawv rau cov txheej txheem tshiab uas txuas nrog ib puag ncig siv qhov kev xaiv "-sib koom".
Ua ntej txuas, nws xyuas seb cov txheej txheem teev tseg puas tau khiav hauv qhov chaw tua hluav taws. Daim tshev no ntsuas qhov muaj cov ntaub ntawv /run/firejail/mnt/join. Txhawm rau siv qhov tsis zoo, tus neeg tawm tsam tuaj yeem sim ua qhov tsis tseeb, tsis nyob hauv tsev kaw neeg raug kaw siv lub mount namespace, thiab txuas mus rau nws siv qhov kev xaiv "--sib koom". Yog tias qhov teeb tsa tsis ua rau hom txwv tsis pub tau txais cov cai ntxiv hauv cov txheej txheem tshiab (prctl NO_NEW_PRIVS), firejail yuav txuas tus neeg siv mus rau ib puag ncig dummy thiab sim siv tus neeg siv lub npe chaw teeb tsa ntawm cov txheej txheem init (PID 1).
Raws li qhov tshwm sim, cov txheej txheem txuas ntawm "firejail -join" yuav xaus rau hauv tus neeg siv tus thawj tus neeg siv ID namespace nrog cov cai tsis hloov pauv, tab sis nyob rau hauv qhov chaw sib txawv mount point, tag nrho tswj los ntawm tus neeg tawm tsam. Tus neeg tawm tsam tuaj yeem ua tiav cov txheej txheem setuid-hauv paus hauv qhov chaw mount point nws tsim, uas tso cai, piv txwv li, hloov /etc/sudoers nqis lossis PAM tsis nyob hauv nws cov ntaub ntawv hierarchy thiab muaj peev xwm ua tiav cov lus txib nrog cov cai hauv paus siv sudo lossis ua utilities.
Tau qhov twg los: opennet.ru