leviathan
9593d90385
Breaking change. Tool name, binary name, function/type names,
constant names, env vars, header guards, file paths, and GitHub
repo URL all rebrand IAMROOT → SKELETONKEY.
Changes:
- All "IAMROOT" → "SKELETONKEY" (constants, env vars, enum
values, docs, comments)
- All "iamroot" → "skeletonkey" (functions, types, paths, CLI)
- iamroot.c → skeletonkey.c
- modules/*/iamroot_modules.{c,h} → modules/*/skeletonkey_modules.{c,h}
- tools/iamroot-fleet-scan.sh → tools/skeletonkey-fleet-scan.sh
- Binary "iamroot" → "skeletonkey"
- GitHub URL KaraZajac/IAMROOT → KaraZajac/SKELETONKEY
- .gitignore now expects build output named "skeletonkey"
- /tmp/iamroot-* tmpfiles → /tmp/skeletonkey-*
- Env vars IAMROOT_MODPROBE_PATH etc. → SKELETONKEY_*
New ASCII skeleton-key banner (horizontal key icon + ANSI Shadow
SKELETONKEY block letters) replaces the IAMROOT banner in
skeletonkey.c and README.md.
VERSION: 0.3.1 → 0.4.0 (breaking).
Build clean on Debian 6.12.86. `skeletonkey --version` → 0.4.0.
All 24 modules still register; no functional code changes — pure
rename + banner refresh.
1.4 KiB
1.4 KiB
Dirty Pipe — CVE-2022-0847
⚪ PLANNED module. See
../../ROADMAP.mdPhase 2.
Summary
Pipe-buffer PIPE_BUF_FLAG_CAN_MERGE was incorrectly inherited by
copy_page_to_iter_pipe() and push_pipe() paths, allowing an
unprivileged user to write into the page cache of any file readable
by them.
Affected kernels
- ≤ 5.16.11
- ≤ 5.15.25 LTS
- ≤ 5.10.102 LTS
Upstream patch
9d2231c5d74e13b2a0546fee6737ee4446017903 ("lib/iov_iter: initialize
"flags" in new pipe_buffer")
Why this module is here
Even in 2026, many production deployments still run vulnerable kernels (RHEL 7/8, older Ubuntu LTS, embedded). Bundling Dirty Pipe makes SKELETONKEY useful as a "historical sweep" tool on long-tail systems.
Implementation plan
- C exploit ported from public PoCs (credit upstream authors in
NOTICE.mdwhen implemented) detect(): kernel version check +/proc/versionparse + test for fixed-version backportsexploit(): writesskeletonkey::0:0:dirtypipe:/:/bin/bashinto/etc/passwd, thensu skeletonkey— same shape as copy_fail's backdoor mode- Detection rules: auditd on splice() calls + pipe write patterns,
filesystem audit on
/etc/passwdmodification by non-root
Not started yet
Pick this up after Phase 1 (module-interface refactor of the
copy_fail family) so this module can use the standard
skeletonkey_module shape from the start.