Skip to content

Commit a25de7f

Browse files
committed
Improve example of privilege escalation failure
1 parent 2a16414 commit a25de7f

File tree

1 file changed

+12
-3
lines changed

1 file changed

+12
-3
lines changed

01-building/README.md

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,13 +87,22 @@ This is one of the core features of Singularity that makes it so attractive from
8787
Let's try installing some software. I used the programs `fortune`, `cowsay`, and `lolcat` to produce the container that we saw in the first demo.
8888

8989
```
90-
Singularity lolcow:~> sudo apt-get update && sudo apt-get -y install fortune cowsay lolcat
91-
bash: sudo: command not found
90+
Singularity lolcow:~> apt-get update && apt-get -y install fortune cowsay lolcat
91+
Reading package lists... Done
92+
W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory (1: Operation not permitted)
93+
E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
94+
E: Unable to lock directory /var/lib/apt/lists/
9295
```
9396

9497
Whoops!
9598

96-
Singularity complains that it can't find the `sudo` command. But even if you try to install `sudo` or change to root using `su`, you will find it impossible to elevate your privileges within the container.
99+
We don't have permission.
100+
But even if we had installed `sudo` into the container and tried to run this command with it, or change to root using `su`, we would still find it impossible to elevate our privileges within the container:
101+
102+
```
103+
Singularity:~> sudo apt-get update
104+
sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
105+
```
97106

98107
Once again, this is an important concept in Singularity. If you enter a container without root privileges, you are unable to obtain root privileges within the container. This insurance against privilege escalation is the reason that you will find Singularity installed in so many HPC environments.
99108

0 commit comments

Comments
 (0)