testing the #copy-fail #security PoC against podman #containers, which, surprisingly, contained it because of “User Namespace UID mappings”; explains how to get strace to work there instead of PTRACE_TRACEME: Operation not permitted. Also how to use bpftrace instead of strace to see syscalls from suid.
“#Docker is a tool to make manual linking easier. More specifically, it’s a tool to let you do manual linking and then save your work.” #virtualization #containers #linkers
on 02015-08-07