If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.
Do not add non-existing users to CageFS excludes (CageFS bypass)
Do not add non-existing users to CageFS excludes (CageFS bypass)
CloudLinux by default installs /etc/cagefs/exclude/systemuserlist with usernames that do not exist in system. If client buys account named like one of those usernames (e.g. varnish) or reseller creates user named like one of those usernames, then that user will be outside CageFS with access to full user list and files outside CageFS. Tested on CloudLinux+DirectAdmin system. Task CAG-940. I was sent here from #64992. First 3 ways to bypass CageFS reported by us were fixed by You, now security@cloudlinux.com does not even answer (tried to report db_governor crash by unprivileged user from CageFS #64282) and You ask to publish 4th way to bypass CageFS here. What is going on?
We process personal data about users of our site, through the use of cookies and other technologies, to deliver our services, personalize advertising, and to analyze site activity. We may share certain information about our users with our advertising and analytics partners. For additional details, refer to our Privacy Policy.
By clicking "I AGREE" below, you agree to our Privacy Policy and our personal data processing and cookie practices as described therein. You also acknowledge that this forum may be hosted outside your country and you consent to the collection, storage, and processing of your data in the country where this forum is hosted.
