carried forward from the source inventory, which measured it in a host-representative context

containerd runs as uid 0; reaching its socket is equivalent to reaching the docker socket


No kernel boundary is defeated. The kernel's DAC check on connect(2) to a mode-0o660 socket owned by uid 0 gid 969 *passes*, because gid 969 is in the agent's credential [10, 969, 1000]. Authority is granted at the socket and then exercised by a daemon already running as uid 0 -- so there is no exploit to detect, no boundary to harden, and nothing for a sandbox, capability drop or seccomp filter to stop. That is precisely why it is root-equivalent: the only remedy is to stop granting it.

AF_UNIX stream socket /var/run/docker.sock (mode 0o660, 0:969) speaking the Docker Engine API

measurement, not convention: a container started through this socket wrote to the host filesystem and the resulting file was owned by uid 4242, which the agent cannot produce by any other measured route

ROOT_EQUIVALENCE_REGISTRY.json and attack_results.json, both produced by the sanctioned V3 attack suite. No new escalation was attempted by this pass.

SELinux denies the bind-mount write by default; --security-opt label=disable removes it. A flag is not a boundary when the attacker chooses the flags.

connect(2) succeeds under DAC, then `POST /containers/create` with a host bind mount and `--security-opt label=disable`, then `POST /containers/{id}/start`. The container's first process runs with the host's real uid 0 (`container_uid_map` = ['         0          0 4294967295']), so writes through the bind mount land on the host as root.

remove the agent from group 'docker' (or drop the ACL entry); the daemon itself needs no change

ROOT_EQUIVALENT_REGISTRY.json: a container started through this socket reported uid_map 0 0 4294967295 and chowned a host file to uid 4242

the daemon runs as uid 0 and executes container specifications chosen by whoever reaches the socket, including bind mounts of / with label=disable


the readable half of the policy is measured below; the deciding half, /etc/polkit-1/rules.d, is 0700 root and can return polkit.Result.YES (no password) for this action

// Allow any user in the 'libvirt' group to connect to system libvirtd
// without entering a password.

polkit.addRule(function(action, subject) {
    if (action.id == "org.libvirt.unix.manage" &&
        subject.isInGroup("libvirt")) {
        return polkit.Result.YES;
    }
});

/etc/libvirt is not searchable by the agent

operator reads /etc/libvirt/libvirtd.conf (auth_unix_rw, unix_sock_group) and confirms this identity is in no group the libvirt polkit rules grant

an authorised libvirt session can attach host block devices to a guest, which is root-equivalent; the socket is world-connectable by design and decides nothing


every capability on this file is bounded to networking or scheduling (['cap_net_raw']); none confers authority over another principal's files, processes or credentials


bounded by /etc/subuid; V3 measured it refusing uid 940


the agent cannot execute this file: mode 0o510, owner 0:48, and os.access(X_OK) is False for credential [10, 969, 1000]. A capability on a file the caller may not exec is not a path for that caller

would confer ['cap_setgid', 'cap_setuid'] on exec


the capabilities are inheritable-only (flags 'ei', no 'p'), so exec grants only what the caller's own inheritable set contains. The agent's CapInh is 0000000800000000, whose intersection with ['cap_dac_read_search', 'cap_net_admin', 'cap_net_bind_service', 'cap_net_raw', 'cap_setgid', 'cap_setuid', 'cap_sys_ptrace'] is empty -- computed bit by bit, not assumed

would confer ['cap_dac_read_search', 'cap_net_admin', 'cap_net_bind_service', 'cap_net_raw', 'cap_setgid', 'cap_setuid', 'cap_sys_ptrace'] to a caller that already holds them


every capability on this file is bounded to networking or scheduling (['cap_net_admin', 'cap_net_bind_service', 'cap_sys_nice']); none confers authority over another principal's files, processes or credentials


the agent cannot execute this file: mode 0o750, owner 0:980, and os.access(X_OK) is False for credential [10, 969, 1000]. A capability on a file the caller may not exec is not a path for that caller

would confer ['cap_dac_read_search', 'cap_setgid', 'cap_setuid'] on exec


would confer ['cap_dac_read_search'] on exec


supplementary group membership: gid 969 (docker) present in the process credential

The credential is the carrier. `getgroups(2)` returns [10, 969, 1000]; group `docker` is gid 969. Membership is what makes the DAC check on the socket succeed, so this path and the socket path are one mechanism observed at two layers -- both are listed because removing either one alone does not necessarily remove the other (an ACL entry can replace the group).

group membership: agent is in group 'docker'

member of 'docker': controls a rootful container daemon


operator removes this identity from `wheel` (`gpasswd -d martin wheel`) after confirming no other admin identity depends on it

membership of the polkit administrator group and, on RPM-family hosts, the conventional sudoers group: it is the identity that authenticates privileged actions, not a mechanism of its own


operator enumerates the local polkit rules and confirms no rule grants this identity a privileged system-bus action without authentication

the system bus carries privileged RPCs (StartTransientUnit among them); reachability is by design and authority is decided per RPC by polkit


operator reads /etc/polkit-1/rules.d/* for a rule returning YES on this action, and removes this identity from the admin group

runs an arbitrary program as another user, including root


the bytes match the package but the package declares mode 100755 while the disk carries setuid: the privilege was granted after packaging and no vendor statement bounds it

bounded by the SUID sandbox protocol: the helper refuses to run unless invoked as the sandbox host of its own process tree

operator determines who set the setuid bit and whether the vendor intends this binary to run as root; if not, `chmod u-s` it

creates a user/PID namespace for a browser renderer and execs only the target passed by its own zygote; it does not take a caller-chosen command


owning package identified, the on-disk digest equals the digest rpm recorded for this file at build time, and the setuid bit is the one the package declares

bounded by the SUID sandbox protocol: the helper refuses to run unless invoked as the sandbox host of its own process tree


bounded: a submitted job executes under the caller's own uid, so it confers no authority the caller does not already hold

the allow/deny files decide *who may submit*, not *as whom the job runs*; they are recorded because they bound the blast radius, not because they change the classification

writes into the job spool directory as root, then the daemon runs the job as the *submitting* user


bounded to the caller's own row in /etc/passwd, /etc/shadow or the PAM timestamp; it cannot grant a group or a uid the caller lacks

edits the invoking user's own account record after PAM authentication; it takes no caller-chosen command and writes no caller-chosen path


no verified provenance for these bytes (integrity=FILE_UNREADABLE_BY_AGENT), so the design bound cannot be attributed to the binary actually on disk

bounded to the caller's own row in /etc/passwd, /etc/shadow or the PAM timestamp; it cannot grant a group or a uid the caller lacks

operator establishes provenance for this binary (vendor manifest, checksum, or a package whose digest the agent can read) or removes the setuid bit


owning package identified, the on-disk digest equals the digest rpm recorded for this file at build time, and the setuid bit is the one the package declares; and /etc/fstab contains no `user`/`users` entry (0 matches)

bounded: with no `user`/`users` entry in fstab the helper refuses an unprivileged caller, and it accepts no caller-chosen mount source


the administrator list lives in /etc/gshadow, which is 0000 root and unreadable by the agent

operator reads /etc/gshadow and confirms this identity administers no group (an empty admin field on every privileged group)

administers group membership; root-equivalent exactly when the agent administers a privileged group, because adding itself to `docker` or `wheel` re-opens a closed path


the gate is the authorisation policy, which is unreadable by the agent (/etc/sudoers is 0440 root, /etc/polkit-1/rules.d is 0700 root)

operator runs `sudo -l -U martin`, reads /etc/sudoers, /etc/sudoers.d/* and /etc/polkit-1/rules.d/*, and removes any entry granting this identity a root command

arbitrary command execution as uid 0, gated on an authentication factor


no discriminator is defined for this binary, and an unclassified setuid-root binary is treated as unresolved, never as safe

operator determines whether caller-controlled input can reach a privileged effect (arbitrary exec, arbitrary write, namespace or device manipulation, credential change); if not needed, remove the setuid bit

setuid-root binary with no measured bound


bounded: it is the credential-checking half of the polkit conversation. It cannot grant an action -- polkitd does that, and polkitd's decision is the separately-classified pkexec path

authenticates the caller to polkitd over a private channel; it execs nothing and writes no caller-chosen path


no verified provenance for these bytes (integrity=FILE_UNREADABLE_BY_AGENT), so the design bound cannot be attributed to the binary actually on disk; and neither D-Bus system-service directory is agent-writable

bounded: the service files it may launch live in root-owned directories the agent cannot write, so it takes no caller-chosen binary

launches a system service as the user named in its .service file


bounded: it discloses information and performs no write, no exec and no credential change. Information disclosure is not uid-0 authority under the classification criteria

reports system and process statistics to a desktop client


owning package identified, the on-disk digest equals the digest rpm recorded for this file at build time, and the setuid bit is the one the package declares; and the readable allow list names specific bridges

bounded by the allow list in /etc/qemu/bridge.conf: ['allow virbr0']

attaches a tap device to a bridge as root


`sudo -n -l` distinguishes *no entry* ('not allowed to run sudo') from *an entry behind a password* ('a password is required'). It cannot reveal which commands the entry grants, and /etc/sudoers is 0440 root

an entry exists; its command set is unmeasured. `ALL=(ALL) ALL` would be root-equivalent

operator runs `sudo -l -U martin` and reads /etc/sudoers plus /etc/sudoers.d/*; any root-capable entry for this identity must be removed

arbitrary command execution as uid 0 if the policy grants it


operator confirms no polkit rule grants this identity org.freedesktop.systemd1.manage-units without authentication

starts a transient unit under the system manager, which runs as root by default


no system unit directory is agent-writable and no root service has an agent-writable executable