The bundled sequence had the mechanism backwards (it PTRACE_ATTACHed the
now-root parent) and never rooted anything. Replaced it with the proven Jann
Horn (Project Zero #1903) / bcoles technique:
- a "middle" process execs setuid pkexec (euid 0 for a window);
- its child spins until it sees middle is euid 0, calls PTRACE_TRACEME
(recording middle's ROOT creds as ptracer_cred — the bug), then execs
pkexec itself. The traced setuid exec is NOT degraded because ptracer_cred
is root, so the child becomes real root, still traced;
- staged execveat() self-re-exec injects the payload as root.
The staged self-re-exec needs the exploit to exist as its own binary with an
argv[0] stage dispatcher, so the proven PoC is embedded verbatim
(ptrace_helper_src.h — only spawn_shell() changed, to plant a root-owned proof
+ setuid bash instead of only an interactive shell), compiled on the target at
runtime with unique -DSK_PROOF/-DSK_ROOTBASH paths, run, and verified by
stat()'ing the root-owned artifacts (never self-report).
Verified out-of-band on Ubuntu 18.04.0 / 4.15.0-50: `skeletonkey --exploit
ptrace_traceme` as uid 1000 -> EXPLOIT_OK + a -rwsr-xr-x root:root bash.
Real-world precondition, honestly reported: pkexec must authorize an
auto-discovered implicit-active=yes helper, which needs an active local session
(desktop) or a permissive polkit policy; over inactive ssh it returns "Not
authorized" and the module reports EXPLOIT_FAIL with that diagnosis. Gated on a
C compiler + pkexec; x86_64 only (register-level injection). cleanup() removes
the artifacts. Unit harness green (33 + 115).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
KaraZajac