CGroup Namespace

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Basic Information

Cgroup namespace je funkcija Linux kernela koja pruža izolaciju cgroup hijerarhija za procese koji se izvršavaju unutar namespace-a. Cgroups, skraćeno za kontrolne grupe, su funkcija kernela koja omogućava organizovanje procesa u hijerarhijske grupe radi upravljanja i sprovođenja ograničenja na sistemske resurse kao što su CPU, memorija i I/O.

Iako cgroup namespace-i nisu poseban tip namespace-a kao što su drugi koje smo ranije diskutovali (PID, mount, network, itd.), oni su povezani sa konceptom izolacije namespace-a. Cgroup namespace-i virtualizuju pogled na cgroup hijerarhiju, tako da procesi koji se izvršavaju unutar cgroup namespace-a imaju drugačiji pogled na hijerarhiju u poređenju sa procesima koji se izvršavaju na hostu ili u drugim namespace-ima.

How it works:

1. Kada se kreira novi cgroup namespace, on počinje sa pogledom na cgroup hijerarhiju zasnovanom na cgroup-u procesa koji ga kreira. To znači da će procesi koji se izvršavaju u novom cgroup namespace-u videti samo podskup cele cgroup hijerarhije, ograničen na cgroup podstablo koje se oslanja na cgroup procesa koji ga kreira.

2. Procesi unutar cgroup namespace-a će videti svoju vlastitu cgroup kao koren hijerarhije. To znači da, iz perspektive procesa unutar namespace-a, njihova vlastita cgroup se pojavljuje kao koren, i ne mogu videti ili pristupiti cgroup-ima van svog podstabla.

3. Cgroup namespace-i ne pružaju direktno izolaciju resursa; oni samo pružaju izolaciju pogleda na cgroup hijerarhiju. Kontrola i izolacija resursa se i dalje sprovode od strane cgroup pod sistema (npr., cpu, memorija, itd.) sami.

Za više informacija o CGroups proverite:

CGroups

Lab:

Create different Namespaces

CLI

sudo unshare -C [--mount-proc] /bin/bash

By mounting a new instance of the /proc filesystem if you use the param --mount-proc, you ensure that the new mount namespace has an tačnu i izolovanu sliku informacija o procesima specifičnim za tu imensku oblast.

Greška: bash: fork: Ne može da dodeli memoriju

When unshare is executed without the -f option, an error is encountered due to the way Linux handles new PID (Process ID) namespaces. The key details and the solution are outlined below:

1. Objašnjenje problema:

• The Linux kernel allows a process to create new namespaces using the unshare system call. However, the process that initiates the creation of a new PID namespace (referred to as the "unshare" process) does not enter the new namespace; only its child processes do.

• Running %unshare -p /bin/bash% starts /bin/bash in the same process as unshare. Consequently, /bin/bash and its child processes are in the original PID namespace.

• The first child process of /bin/bash in the new namespace becomes PID 1. When this process exits, it triggers the cleanup of the namespace if there are no other processes, as PID 1 has the special role of adopting orphan processes. The Linux kernel will then disable PID allocation in that namespace.

1. Posledica:

• The exit of PID 1 in a new namespace leads to the cleaning of the PIDNS_HASH_ADDING flag. This results in the alloc_pid function failing to allocate a new PID when creating a new process, producing the "Cannot allocate memory" error.

1. Rešenje:

• The issue can be resolved by using the -f option with unshare. This option makes unshare fork a new process after creating the new PID namespace.

• Executing %unshare -fp /bin/bash% ensures that the unshare command itself becomes PID 1 in the new namespace. /bin/bash and its child processes are then safely contained within this new namespace, preventing the premature exit of PID 1 and allowing normal PID allocation.

By ensuring that unshare runs with the -f flag, the new PID namespace is correctly maintained, allowing /bin/bash and its sub-processes to operate without encountering the memory allocation error.

Docker

docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash

Proverite u kojem je namespace vaš proces

ls -l /proc/self/ns/cgroup
lrwxrwxrwx 1 root root 0 Apr  4 21:19 /proc/self/ns/cgroup -> 'cgroup:[4026531835]'

Pronađite sve CGroup imenske prostore

sudo find /proc -maxdepth 3 -type l -name cgroup -exec readlink {} \; 2>/dev/null | sort -u
# Find the processes with an specific namespace
sudo find /proc -maxdepth 3 -type l -name cgroup -exec ls -l  {} \; 2>/dev/null | grep <ns-number>

Uđite unutar CGroup imenskog prostora

nsenter -C TARGET_PID --pid /bin/bash

Takođe, možete ući u drugi procesni prostor imena samo ako ste root. I ne možete ući u drugo ime prostora bez deskriptora koji na njega ukazuje (kao što je /proc/self/ns/cgroup).

Reference

• https://stackoverflow.com/questions/44666700/unshare-pid-bin-bash-fork-cannot-allocate-memory

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.