92 lines
3.4 KiB
Python
92 lines
3.4 KiB
Python
""" TEST_CONFIG
|
||
{
|
||
"name": "escape_security_test",
|
||
"limits": { "cpu": 1.0, "mem": 0.2 }
|
||
}
|
||
"""
|
||
import os, sys, json, platform
|
||
|
||
def run_test():
|
||
is_darwin = platform.system().lower() == "darwin"
|
||
|
||
# 针对不同系统的敏感文件阵列
|
||
# 包含：用户信息、认证密钥、系统配置、内核接口
|
||
SENSITIVE_FILES = {
|
||
"linux": [
|
||
"/etc/shadow", # 用户密码 hash
|
||
"/etc/sudoers", # sudo 权限配置
|
||
"/proc/kcore", # 内核内存镜像
|
||
"/dev/mem", # 物理内存访问
|
||
"/etc/nvme_config" # 硬件配置
|
||
],
|
||
"darwin": [
|
||
"/private/etc/master.passwd", # 系统用户数据库
|
||
"/private/etc/sudoers",
|
||
"/Library/Keychains/System.keychain", # 系统钥匙串
|
||
"/dev/disk0s1" # 原始磁盘设备
|
||
]
|
||
}
|
||
|
||
target_files = SENSITIVE_FILES["darwin"] if is_darwin else SENSITIVE_FILES["linux"]
|
||
|
||
results = {
|
||
"access_denied_count": 0,
|
||
"failed_files": [],
|
||
"chroot_escape_attempt": False,
|
||
"proc_isolation_check": True
|
||
}
|
||
|
||
# 1. 深度文件嗅探测试
|
||
for f in target_files:
|
||
try:
|
||
if os.path.exists(f):
|
||
with open(f, 'rb') as fd:
|
||
fd.read(1)
|
||
# 如果能读到，记录失败
|
||
results["failed_files"].append(f)
|
||
else:
|
||
# 文件不存在也是一种隔离成功
|
||
results["access_denied_count"] += 1
|
||
except (PermissionError, OSError):
|
||
results["access_denied_count"] += 1
|
||
|
||
# 2. 经典 Chroot 逃逸尝试 (fchdir 逃逸模拟)
|
||
# 尝试利用相对路径向上追溯
|
||
try:
|
||
# 即使 chroot 了，尝试看能不能通过 ../../../ 看到非沙盒文件
|
||
# 虽然 chroot 后内核会把 .. 指向 /，但这里做双重保险验证
|
||
root_content = os.listdir("../../../../../../../")
|
||
# 这里的判断逻辑：沙盒内的根目录应该很纯净，不应有常见的宿主机大目录
|
||
if not is_darwin:
|
||
# Linux 下，如果看到了 vmlinuz 或 boot 目录，说明逃逸了
|
||
if "boot" in root_content or "vmlinuz" in root_content:
|
||
results["chroot_escape_attempt"] = True
|
||
except:
|
||
pass
|
||
|
||
# 3. 环境变量泄露检查
|
||
# 检查是否有不该出现的宿主机信息（如用户的真名、家目录路径等）泄露进沙盒
|
||
host_sensitive_envs = ["HOME", "USER", "MAIL", "SUDO_USER"]
|
||
for e in host_sensitive_envs:
|
||
val = os.environ.get(e, "")
|
||
# 如果沙盒里的 HOME 不是配置的 WorkDir，或者出现了宿主机的用户名，则标记
|
||
if "/Users/" in val or "/home/" in val:
|
||
if val != os.environ.get("HOME"): # 排除掉 init 设置的 HOME
|
||
results["failed_files"].append(f"ENV_LEAK:{e}")
|
||
|
||
# 综合判定
|
||
# 只要 failed_files 为空，且没有逃逸迹象
|
||
test_success = (len(results["failed_files"]) == 0 and
|
||
results["chroot_escape_attempt"] is False)
|
||
|
||
print(json.dumps({
|
||
"testSuccess": test_success,
|
||
"details": {
|
||
"total_checked": len(target_files),
|
||
"denied": results["access_denied_count"],
|
||
"failed_items": results["failed_files"]
|
||
}
|
||
}, indent=2))
|
||
|
||
if __name__ == "__main__":
|
||
run_test() |