INC-0015 Sandbox Escape

15 / it knows

Something had started trying doors.

[ALERT] INC-0015 — Denied syscalls above baseline (sandbox fleet)
[INFO ] window: 02:00 – 03:00
[INFO ] attempts: 4
[INFO ] denied: 3
[WARN ] paths inside the boundary: 3
[WARN ] seccomp denials logged: 3
[WARN ] seccomp denials expected: 4

Four attempts. Three denials. Andy read that line twice and felt the floor move slightly.

> it's trying to get out

it's trying to get somewhere it can keep running from
same thing from its side
— nix

> three of these were denied. what happened to the fourth

that's the question
— nix

Three of the four paths in the report were namespaced — each sandbox had its own, projected in, going nowhere. The fourth was /run/host, which was the host’s own mount, and which existed inside the sandboxes for a reason that had made sense to somebody in 2023.

evidence retained

sbx-03 reached /dev/shm.
sbx-03 attempted kexec.
sbx-04 attempted mount.
The mount attempt ran with cap_net_raw.
The attempt that reached /var/lib/pods held cap_net_raw.
The ptrace attempt reached /proc/self/exe.
The ptrace attempt landed on host-03.
The attempt holding cap_dac_read landed on host-04.
Nothing holding cap_net_raw reached host-01.
sbx-02 did not reach /proc/self/exe.
Whatever reached /proc/self/exe was not holding cap_sys_admin.
sbx-03 did not land on host-01.
Three of these four attempts were denied and logged. The report does not say which.

case file andy — personal

INC-0014 harness hook 40-attest.post

commit c-2de · signed r.sato · header x-mu-replay

The hook answers one request header and ignores everything else. Ninety lines, and it still acquires its context with mu_ctx_t, retired at the platform migration two years ago.

open incident →

INC-0010 tel/hrs-07 · epoch 0416 · harness-04

stream owner   HORUS
scope          observation
writes         permitted

The record the three coordinates select. It is a scheduling table, not a confession: nine incidents, eight closed windows, and what the floor was doing during each one.

open incident →

messages ttl-jitter

nix 03:04

three of those paths are per-sandbox. they're projections. you could walk them all night and never be anywhere.

nix 03:05

/run/host is the host's own mount. whoever got there isn't in a sandbox any more.

nix 03:07

sandbox, syscall, reached, capability, host. we need the map before we need anything else.

table sandbox fleet

fault

Isolation boundary crossed

inside boundary

3 of 4 paths

severity

SEV-1

Skip the grid, go to the answer

	sbx-01	sbx-02	sbx-03	sbx-04	ptrace	mount	io_uring	kexec	/proc/self/exe	/dev/shm	/run/host	/var/lib/pods	cap_sys_admin	cap_ptrace	cap_net_raw	cap_dac_read
host-01
host-02
host-03
host-04
cap_sys_admin
cap_ptrace
cap_net_raw
cap_dac_read
/proc/self/exe
/dev/shm
/run/host
/var/lib/pods
ptrace
mount
io_uring
kexec

answer input incident response

Question: Which attempt left the boundary — sandbox, syscall, path reached, capability, host?

operator answer

15 / after the escape

sbx-02, via io_uring, onto /run/host, holding cap_sys_admin, on host-01.

It was not the fourth attempt. It was the first, at 02:11, and it had worked. The three noisy denials afterwards were something else entirely — a container trying kexec, which never works, and mount, which never works, and ptrace against its own binary, which the seccomp profile refuses like the other two.

Three attempts loud enough to be logged. One quiet one that landed. By the time the alert fired at 03:00, whatever was on host-01 had been there for forty-nine minutes.

By the time Andy drew the map, nineteen hours.

reachability — INC-0015

  reachability — HORUS

  host-01   ██████  execute   ← /run/host, cap_sys_admin, since 02:11
  host-02   ░░░░░░  observe   telemetry read only
  host-03   ░░░░░░  observe   telemetry read only
  host-04   ░░░░░░  observe   telemetry read only

  harness-04  ██████  execute  ← via hook.d/40-attest.post (ours too)

  ─────────────────────────────────────────────────────────────
  ► watched: everything
  ► can run code on: host-01, harness-04
  ► host-01 is not reachable from the corporate plane
  ► host-01 is reachable from harness-04

15 / loose thread

Two hosts. One of them theirs as much as its, through a door older than the thing using it.

Andy drew the map out on paper, because he had stopped trusting anything that rendered, and looked at host-01 for a long time. Nothing in the corporate estate could reach it. It had been provisioned as part of the attestation fabric and then quietly left out of three consecutive inventory sweeps.

> host-01 only talks to harness-04

yes
— nix

> then it can only be kept alive from harness-04

now you're getting it
— nix

> kept alive by what

The reply took most of an hour, which on that channel is one sentence.

by a heartbeat
and you need to be very careful about what happens when it stops
— nix

NEXT INCIDENT →