Jerry/D-Modem
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

merge into: Jerry:dev-old
Branches Tags
Jerry:master
Jerry:dev
Jerry:dev-old
Jerry:dev1
Jerry:master-old
Jerry:priv
...
pull from: Jerry:master
Branches Tags
Jerry:dev
Jerry:master
Jerry:dev-old
Jerry:dev1
Jerry:master-old
Jerry:priv

No commits in common. "dev-old" and "master" have entirely different histories.
dev-old ... master

1 changed files with 8 additions and 22 deletions
Show stats Expand all files Collapse all files

28
mm.py
View file

@ -282,27 +282,13 @@ class Modem:
PR_CAP_AMBIENT_CLEAR_ALL = 4
PR_GET_SECUREBITS = 27
PR_SET_SECUREBITS = 28
libc = ctypes.CDLL('/usr/lib/libc.so.6')
assert libc.prctl(
ctypes.c_int(PR_SET_NO_NEW_PRIVS),
ctypes.c_int(1),
ctypes.c_int(0),
ctypes.c_int(0),
ctypes.c_int(0)
) == 0
assert libc.prctl(
ctypes.c_int(PR_CAP_AMBIENT),
ctypes.c_int(PR_CAP_AMBIENT_CLEAR_ALL),
ctypes.c_int(0),
ctypes.c_int(0),
ctypes.c_int(0)
) == 0
libc.prctl(
PR_SET_SECUREBITS,
ctypes.c_int(0x2f) # SECBIT_KEEP_CAPS_LOCKED | SECBIT_NO_SETUID_FIXUP | SECBIT_NO_SETUID_FIXUP_LOCKED | SECBIT_NOROOT | SECBIT_NOROOT_LOCKED
)
assert libc.prctl(ctypes.c_int(PR_GET_SECUREBITS)) == 0x2f
libc = ctypes.CDLL('libc.so.6')
libc.prctl.restype = ctypes.c_int
assert libc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == 0
assert libc.prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0) == 0
assert libc.prctl(PR_SET_SECUREBITS, 0x2f) == 0
# SECBIT_KEEP_CAPS_LOCKED | SECBIT_NO_SETUID_FIXUP | SECBIT_NO_SETUID_FIXUP_LOCKED | SECBIT_NOROOT | SECBIT_NOROOT_LOCKED
assert libc.prctl(PR_GET_SECUREBITS) == 0x2f
os.setgroups([])
os.setresgid(gid, gid, gid)
os.setresuid(uid, uid, uid)