Two real bugs found via VM verification (Ubuntu 20.04.0 / 5.4.0-26):
1. uid_map EPERM: the child captured getuid()/getgid() AFTER
unshare(CLONE_NEWUSER), where they return 65534 (nobody, the initial
unmapped id), so it wrote "0 65534 1" to uid_map — rejected with EPERM.
Now the outer uid/gid are read BEFORE unshare, yielding the correct
"0 <uid> 1" single-uid self-map. (overlayfs got this right, which is why
it worked; this module didn't.)
2. mount EPERM: the unprivileged cgroup-v1 mount needs a private cgroup
namespace. Added CLONE_NEWCGROUP (with a fallback) — mounting an unused v1
controller then succeeds.
With both fixed the userns+cgroupns+mount setup is correct. Note: on a stock
systemd host every v1 controller is already mounted (its release_agent is
owned by init-root and unwritable from the userns) and creating a fresh named
hierarchy is refused, so a bare unprivileged user cannot own release_agent —
CVE-2022-0492 is reachable in a container context (CAP_SYS_ADMIN / an ownable
cgroup), consistent with the module's "host root from rootless container"
framing. Verified out-of-band; see docs/EXPLOITED.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
KaraZajac
8c45b2beb8