Skip to content

Latest commit

 

History

History
34 lines (32 loc) · 1.42 KB

README.md

File metadata and controls

34 lines (32 loc) · 1.42 KB
Raw

This project aims to test sVirt protection on VM escape. We use socket to simulate VM escape instead of reproducing really VM escape. Test env: libvirt 5.5.0, qemu 4.1.0, virt-manager 2.2.1, selinux-policy 3.14.2.

How to use

  1. Copy this project to /root dir of both host and vm.
  2. Make sure network connection between vm and host is available and PORT 28080 is open.
  3. Change /root/test-svirt/vm.c SERVER_IP to host IP.
  4. Change host SElinux to Permissive mode.
  5. Login to host shell, exec 'bash make.sh' in /root/test-svirt, then exec './server_utils'.
  6. Login to vm shell, exec 'bash make.sh' in /root/test-svirt, then exec './vm_escape'.
  7. VM 'escape' shoule be success, following output shows on vm shell:
Set selinux context success!
I am an escaped process! My selinux label is: system_u:system_r:svirt_t:s0:c97,c105
Now I want to attack host file!
Attack host succeed!
Now I want to attack VM file!
Attack VM succeed!
Now I want to execute shell command: 'getenforce'！
Permissive
Exec getenforce success!
Exec attack success!
---------------------------------------------------------------------
  1. Login to host shell, exec 'setenforce 1', enable sVirt protection.
  2. Login to vm shell, exec './vm_escape', the escape would be stopped with follow output:
Set selinux context success!
Exec attack failed!
Stop vm escape successfully!
---------------------------------------------------------------------