• roberto [any]@hexbear.netEnglish
      8·
      19 days ago

      They are:

      [user@shithouse:/tmp/dirtyfrag] > lsmod | grep -E '(esp|rxrpc)'
esp6                   28672  0
rxrpc                 258048  0
ip6_udp_tunnel         16384  1 rxrpc
udp_tunnel             20480  1 rxrpc
esp4                   28672  0

      [user@shithouse:/tmp/dirtyfrag] > zgrep -Ei '(rxrpc|inet.?_esp)' /proc/config.gz 
CONFIG_INET_ESP=m
CONFIG_INET_ESP_OFFLOAD=m
CONFIG_INET_ESPINTCP=y
CONFIG_INET6_ESP=m
CONFIG_INET6_ESP_OFFLOAD=m
CONFIG_INET6_ESPINTCP=y
CONFIG_AF_RXRPC=m
# CONFIG_AF_RXRPC_IPV6 is not set
# CONFIG_AF_RXRPC_INJECT_LOSS is not set
# CONFIG_AF_RXRPC_DEBUG is not set
      • kungen@feddit.nuEnglish
        6·
        18 days ago

        What distro? Check dmesg, it’s probably AppArmor blocking unprivileged_userns.

        • roberto [any]@hexbear.netEnglish
          5·
          18 days ago

          Void.

          Kernel log has only these two messages from when the modules were loaded, none after that:

          [12660744.186643] Initializing XFRM netlink socket
[12660751.925450] NET: Registered PF_RXRPC protocol family

          No apparmor:

          CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"

          [user@shithouse:~] > aa-enabled
No - disabled at boot.

          Isn’t half of the exploit intended to work around apparmor?