[Ask] What services are outside of CageFS?

[hatoan.vniss]

Hi CL-er,

Im working with CL (kernel 2.6.32-604.30.3.lve1.3.63.el6.x86_64 ). CageFS will hide all sensitive information. According to CL docs, WebDAV, cPanel file manager, webmail can be attacked by symlink bypass. So, What services are outside of CageFS?

How local attack can perform in CL?

[bogdan.sh]

Hello,

It is easier to answer what is limited to cagefs - it will cage any scripts execution done via:

- Apache (suexec, suPHP, mod_fcgid, mod_fastcgi)•
- LiteSpeed Web Server
- Cron Jobs
- SSH
- Any other PAM enabled service

Cpanel work as root user and its file manager works outside of CageFS. Actually, thats why symlink protection has been implemented.
Same for their webmail. We do not know any kind of attack that could bypass cagefs and jump outside.