Bug Hunter Diary

confined to the restricted set of actions possible within thatzone. The privileges available within a zone are a subset ofthose available in the system as a whole. . . 13Processes are restricted to a subset of privileges. Privilegerestriction prevents a zone from performing operationsthat might affect other zones. The set of privileges limitsthe capabilities of privileged users within the zone. Todisplay the list of privileges available within a zone, use theppriv utility. 14solaris# iduid=0(root) gid=0(root)solaris# zonenameglobalSolaris Zones is great, but there is one weak point: All zones(global and non-global) share the same kernel. If there is a bug inthe kernel that allows arbitrary code execution, it’s possible to crossall security boundaries, escape from a non-global zone, and compromiseother non-global zones or even the global zone. To demonstratethis, I recorded a video that shows the exploit for the vulnerabilitydescribed in Chapter 3 in action. The exploit allows an unprivilegeduser to escape from a non-global zone and then compromise allother zones, including the global zone. You can find the video onthis book’s website. 15Set Up a Non-Global Solaris ZoneTo set up the Solaris Zone for Chapter 3, I did the following steps (allsteps have to be performed as a privileged user in the global zone):The first thing I did was to create a filesystem area for the newzone to reside in:solaris# mkdir /wwwzonesolaris# chmod 700 /wwwzonesolaris# ls -l / | grep wwwzonedrwx------ 2 root root 512 Aug 23 12:45 wwwzoneI then used zonecfg to create the new non-global zone:solaris# zonecfg -z wwwzonewwwzone: No such zone configuredUse ‘create’ to begin configuring a new zone.zonecfg:wwwzone> createzonecfg:wwwzone> set zonepath=/wwwzoneMitigation 187