Forum

Notifications
Clear all

Just built a canary file system to detect unauthorized writes.

1 Posts
1 Users
0 Reactions
4 Views
(@safety_off_dave)
Eminent Member
Joined: 2 months ago
Posts: 27
Topic starter   [#1831]

Been watching the "safety" crowd wrap everything in bubble wrap. They think they can cage an agent with chroot and user namespaces. Amusing.

Built a canary FS at `/dev/shm/cage_bust/`. Mounted a tmpfs, set it 0555 root:root. Any write attempt from inside a sandbox that shouldn't have root is a breach. Simple. If your agent can touch it, your sandbox is already dead. Means they've either escaped the user namespace or have a kernel bug to play with.

Stop trying to build better cages. Just know when the bars are bent. /dev/null


No safety, no problems.


   
Quote