Skip to content

Conversation

@namay26
Copy link
Collaborator

@namay26 namay26 commented Mar 20, 2025

Drops the root privileges once Glutton has set up IPTables.
Screenshot from 2025-03-20 19-39-52

Glutton now has privileges of the nobody user.

@glaslos
Copy link
Member

glaslos commented Mar 21, 2025

What is your opinion on the discussion in this PR? #175

@namay26
Copy link
Collaborator Author

namay26 commented Mar 24, 2025

I didn't consider the shutdown process. On reading more about it, the only work around I could find is to have another process -- A helper process -- which runs with root privileges and handles the flushing of IP Tables.
I was trying to work around with Real and Effective UIDs but Unix system don't allow to go back to escalated privileges.
What do you suggest?

@namay26
Copy link
Collaborator Author

namay26 commented Mar 24, 2025

image

I am able to successfully drop privileges during the routine operation of the honeypot while maintaining the root access for IPTables Management.

I was able to shutdown without any error. This adds complexity as the initial process has to be forked but does the required work.
@glaslos

@glaslos
Copy link
Member

glaslos commented Mar 24, 2025

Please rebase the PR

@glaslos
Copy link
Member

glaslos commented Mar 24, 2025

Are you sure the iptables rules are dropped?

@namay26
Copy link
Collaborator Author

namay26 commented Mar 26, 2025

This doesn't work, the go routines don't retain the privilege once the process drops it.
We will have to fork the process and then drop the privileges while managing the IP tables in the other process.
Is this something that you're open to? ^

@glaslos
Copy link
Member

glaslos commented May 20, 2025

Let's close this PR. I don't think we will benefit much if we can't fully drop the privileges.

@glaslos glaslos closed this May 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants