uts-namespace.md (4740B)
1 --- 2 title: "UTS Namespace" 3 section: "Linux" 4 sectionSlug: "linux-hardening" 5 sourcePath: "src/linux-hardening/containers-namespaces/container-security/protections/namespaces/uts-namespace.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/linux-hardening/containers-namespaces/container-security/protections/namespaces/uts-namespace.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # UTS Namespace 14 15 ## Overview 16 17 The UTS namespace isolates the **hostname** and **NIS domain name** seen by the process. At first glance this may look trivial compared with mount, PID, or user namespaces, but it is part of what makes a container appear to be its own host. Inside the namespace, the workload can see and sometimes change a hostname that is local to that namespace rather than global to the machine. <sup>[[1]](#references)</sup> 18 19 On its own, this is usually not the centerpiece of a breakout story. However, once the host UTS namespace is shared, a sufficiently privileged process may influence host identity-related settings, which can matter operationally and occasionally security-wise. 20 21 ## Lab 22 23 You can create a UTS namespace with: 24 25 ```bash 26 sudo unshare --uts --fork bash 27 hostname 28 hostname lab-container 29 hostname 30 ``` 31 32 The hostname change remains local to that namespace and does not alter the host's global hostname. This is a simple but effective demonstration of the isolation property. 33 34 ## Runtime Usage 35 36 Normal containers get an isolated UTS namespace. Docker and Podman can join the host UTS namespace through `--uts=host`, and lower-level runtimes can omit the UTS namespace from an OCI configuration to inherit the runtime namespace. Most of the time, however, private UTS isolation is simply part of the normal container setup and requires little operator attention. <sup>[[2]](#references)</sup> 37 38 ## Security Impact 39 40 Even though the UTS namespace is not usually the most dangerous one to share, it still contributes to the integrity of the container boundary. If the host UTS namespace is exposed and the process has the necessary privileges, it may be able to alter host hostname-related information. That may affect monitoring, logging, operational assumptions, or scripts that make trust decisions based on host identity data. 41 42 ## Abuse 43 44 If the host UTS namespace is shared, the practical question is whether the process can modify host identity settings rather than just read them: 45 46 ```bash 47 readlink /proc/self/ns/uts 48 hostname 49 cat /proc/sys/kernel/hostname 50 ``` 51 52 If the container also has the necessary privilege, test whether the hostname can be changed: 53 54 ```bash 55 hostname hacked-host 2>/dev/null && echo "hostname change worked" 56 hostname 57 ``` 58 59 This is primarily an integrity and operational-impact issue rather than a full escape, but it still shows that the container can directly influence a host-global property. 60 61 Impact: 62 63 - host identity tampering 64 - confusing logs, monitoring, or automation that trust the hostname 65 - usually not a full escape on its own unless combined with other weaknesses 66 67 On Docker-style environments, a useful host-side detection pattern is: 68 69 ```bash 70 docker ps -aq | xargs -r docker inspect --format '{{.Id}} UTSMode={{.HostConfig.UTSMode}}' 71 ``` 72 73 Containers showing `UTSMode=host` are sharing the host UTS namespace and should be reviewed more carefully if they also carry capabilities that let them call `sethostname()` or `setdomainname()`. 74 75 ## Checks 76 77 These commands are enough to see whether the workload has its own hostname view or is sharing the host UTS namespace. 78 79 ```bash 80 readlink /proc/self/ns/uts # UTS namespace identifier 81 hostname # Hostname as seen by the current process 82 cat /proc/sys/kernel/hostname # Kernel hostname value in this namespace 83 ``` 84 85 What is interesting here: 86 87 - Matching namespace identifiers with a host process may indicate host UTS sharing. 88 - If changing the hostname affects more than the container itself, the workload has more influence over host identity than it should. 89 - This is usually a lower-priority finding than PID, mount, or user namespace issues, but it still confirms how isolated the process really is. 90 91 In most environments, the UTS namespace is best thought of as a supporting isolation layer. It is rarely the first thing you chase in a breakout, but it is still part of the overall consistency and safety of the container view. 92 93 ## References 94 95 - [1] [`uts_namespaces(7)` - Linux manual page](https://man7.org/linux/man-pages/man7/uts_namespaces.7.html) 96 - [2] [Open Container Initiative - Linux container namespaces](https://github.com/opencontainers/runtime-spec/blob/main/config-linux.md#namespaces)