/proc and /sys are not ordinary files: many entries are control points the kernel reads back and acts on. A handful name a program the kernel runs, as root in the host's init namespaces, when some event occurs: a crash (core_pattern), an auto-load of a kernel module (modprobe), or a device uevent (uevent_helper). Others expose host memory directly (kcore) or let a process poke the host kernel (sysrq-trigger). These are escapes only when the container has the host's real procfs or sysfs mounted and writable, which happens with a careless -v /proc:/host/proc, a procfs remount, or a privileged container.
Check what is exposed and writable:
mount | grep -E 'proc|sys' # look for host proc/sys without "ro"
ls -l /proc/sys/kernel/core_pattern /proc/sys/kernel/modprobe 2>/dev/null
ls -l /sys/kernel/uevent_helper 2>/dev/null
for f in /proc/sys/kernel/core_pattern /proc/sys/kernel/modprobe /sys/kernel/uevent_helper; do
[ -w "$f" ] && echo "writable: $f"; done
Subtopics#
- core_pattern: pipe a crashing process's core dump to a host program.
- modprobe path: hijack the module auto-loader the kernel runs as root.
- uevent_helper: run a program on a device uevent.
- binfmt_misc: register an interpreter for a file format.
- sysrq-trigger: invoke host kernel magic-sysrq actions.
- host process access: read host process memory and environment.
- kcore memory read: dump host kernel memory through /proc/kcore.