fix(exp): unprivileged_userns_clone sysctl file do not exist in CentOS

pkg/exploit/abuse_unpriv_userns.go

@@ -29,11 +29,9 @@ import (
 	"github.com/cdk-team/CDK/pkg/plugin"
 	"github.com/cdk-team/CDK/pkg/util"
 	"golang.org/x/sys/unix"
-	"io/ioutil"
 	"log"
 	"os"
 	"os/exec"
-	"strings"
 	"syscall"
 )
 
@@ -77,15 +75,6 @@ func UnprivUserNS(cmd string) error {
 		return &errors.CDKRuntimeError{Err: nil, CustomMsg: "exploit only suitable for cgroup v1"}
 	}
 
-	// check prerequisites
-	data, err := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone")
-	if err != nil {
-		return &errors.CDKRuntimeError{Err: err, CustomMsg: "check prerequisites error."}
-	}
-
-	if strings.TrimSuffix(string(data), "\n") != "1" {
-		return &errors.CDKRuntimeError{Err: nil, CustomMsg: "host os does NOT enable unprivileged user namespace."}
-	}
 	// prerequisites satisfied, move current process in new user namespace
 	// https://elixir.bootlin.com/linux/v5.16.13/source/kernel/fork.c#L2957
 	// unshare can only be used in single-thread program. Golang program is always multi-thread.

pkg/util/namespace.go

@@ -0,0 +1,29 @@
+package util
+
+import (
+	"io/ioutil"
+	"strings"
+
+	"github.com/cdk-team/CDK/pkg/errors"
+)
+
+// CheckUnpriUserNS checks if the current host enable unprivileged user namespace.
+// reference:
+//   https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
+//   https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/
+// exceptional case:
+//  the sysctl files(/proc/sys/kernel/unprivileged_userns_clone) only exist in Debian, Ubuntu.
+//  We can not check the sysctl file in other distros, test in CentOS Linux release 8.4.2105 (Core).
+func CheckUnpriUserNS() error {
+
+	data, err := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone")
+	if err != nil {
+		return &errors.CDKRuntimeError{Err: err, CustomMsg: "check prerequisites error."}
+	}
+
+	if strings.TrimSuffix(string(data), "\n") != "1" {
+		return &errors.CDKRuntimeError{Err: nil, CustomMsg: "host os does NOT enable unprivileged user namespace."}
+	}
+
+	return nil
+}