If a process can actually interfere with the others, is it possible to trace it down? By breaking the jail, I mean it overcame the virtualization that prevents one process to interact with the others directly.


It depends on exactly how the break-out is done.

If you're talking about breaking out of a chroot() jail, the PID of the process won't change and something like strace should have no problem producing a trace of it.

If the break-out happens by exploiting a kernel or hardware weakness, attempts to trace the jailed process across the exploit might produce very strange results or even outright crash the tracing tool and/or the VM, as the extra actions required by tracing may not fit the "hole" opened by the exploit.

Or if the exploit happens at the assembler level, it might not register at all for strace. Remember that strace mainly traces system calls and signals: an exploit might be based on first preparing some code in memory in a particular way, and then executing a very specific series of assembler-level operations, none of which may require making any system calls at all. To even see that, you would need to use a debugger (gdb or similar) that can single-step individual CPU instructions... and even then, the act of tracing across the exploit might prevent the exploit from working as intended.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.