News for hackers. Stuff that matters.

A comment on How We Exploited CodeRabbit: From Simple PR to RCE and Write Access on 1M Repos. Parent comment

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by elpakal on Tuesday August 19, 2025 @02:26PM (#44954648)
> Sandboxing: All Cloud Run instances are sandboxed with two layers of sandboxing and can be configured to have minimal IAM permissions via dedicated service identity. In addition, CodeRabbit is leveraging Cloud Run's second generation execution environment, a microVM providing full Linux cgroup functionality. Within each Cloud Run instance, CodeRabbit uses Jailkit to create isolated processes and cgroups to further restrict the privileges of the jailed process.

In case you don't want to read through the PR

[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by 0x457 on Tuesday August 19, 2025 @04:07PM (#44955735)
I don't get it, if you're running on linux then just use Landlock LSM inside a VM.
[ Parent | on HN ]