capsh doesn't work with the container image which has no /bin/bash #10

mhiramat · 2016-12-07T02:20:52Z

Capsh is a great tool to drop capabilities for preventing jailbreak from chroot.
However, it hardcodes /bin/bash to run(in chrooted rootfs), thus we can not run
containers which don't have /bin/bash.

Maybe we have 3 options;

If there is no /bin/bash but /bin/sh, add a wrapper shell script as /bin/bash. (which just exec /bin/sh with given parameters)
If there is no /bin/sh, we just fail to run, and warn the reason.
Fix capsh (to use /bin/sh or just directly run given command) or make another command.

If given rootfs has no /bin/bash, we can not use capsh. In that case, we warn it before run the command. This partially fix issue #10.

mhiramat · 2016-12-10T03:41:24Z

This commit just avoid using capsh. I would like to try contribute capsh to support -x (exec) mode or make capexec to fix this issue.

mhiramat · 2016-12-10T14:53:20Z

See my libcap repository. I committed 2 patches which allow minc to execute given command directly from capsh.

mhiramat added a commit that referenced this issue Dec 10, 2016

minc-exec: Check whether /bin/bash exists in rootfs

effadca

If given rootfs has no /bin/bash, we can not use capsh. In that case, we warn it before run the command. This partially fix issue #10.

mhiramat self-assigned this Jun 19, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

capsh doesn't work with the container image which has no /bin/bash #10

capsh doesn't work with the container image which has no /bin/bash #10

mhiramat commented Dec 7, 2016

mhiramat commented Dec 10, 2016

mhiramat commented Dec 10, 2016 •

edited

Loading

capsh doesn't work with the container image which has no /bin/bash #10

capsh doesn't work with the container image which has no /bin/bash #10

Comments

mhiramat commented Dec 7, 2016

mhiramat commented Dec 10, 2016

mhiramat commented Dec 10, 2016 • edited Loading

mhiramat commented Dec 10, 2016 •

edited

Loading