Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.

SKILL: Linux Security Bypass — Expert Attack Playbook AI LOAD INSTRUCTION : Expert techniques for bypassing Linux security mechanisms. Covers restricted shell escape, noexec bypass, AppArmor/SELinux evasion, seccomp circumvention, and audit evasion. Base models miss DDexec, memfd create fileless execution, and architecture confusion seccomp bypass. 0. RELATED ROUTING Before going deep, consider loading: [linux privilege escalation](../linux privilege escalation/SKILL.md) once you've broken out of restrictions and need to escalate [container escape techniques](../container escape techniques/SKILL.md) when security mechanisms are container specific (seccomp profiles, AppArmor docker default) [linux lateral movement](../linux lateral movement/SKILL.md) after bypassing restrictions for pivoting [cmdi command injection](../cmdi command injection/SKILL.md) when the restriction is on command execution from a web application context 1. RESTRICTED BASH (rbash) BYPASS 1.1 SSH Based Bypass 1.2 Editor Based Escape 1.3 Language Interpreter Escape Interpreter Command Python python3 c 'import pty; pty.spawn("/bin/bash")' Perl perl e 'exec "/bin/bash";' Ruby ruby e 'exec "/bin/bash"' Lua lua e 'os.execute("/bin/bash")' PHP php r 'system("/bin/bash");' Node.js node e 'require("child process").spawn("/bin/bash",{stdio:[0,1,2]})' AWK awk 'BEGIN {system("/bin/bash")}' 1.4 Environment Variable Tricks 1.5 Other Escapes Method Command expect expect c 'spawn /bin/bash; interact' script script qc /bin/bash /dev/null rlwrap rlwrap /bin/bash nmap (old) nmap interactive → !bash 2. READ ONLY / NOEXEC FILESYSTEM EXECUTION 2.1 DDexec — Execute From stdin via /proc/self/mem 2.2 memfd create — In Memory File Descriptor 2.3 ld.so Direct Execution 2.4 Script Interpreters on noexec 2.5 Writable Mount Points 3. APPARMOR BYPASS 3.1 Profile Enumeration 3.2 Exploitation Strategies Common AppArmor profile gaps: /proc/self/fd/ access, abstract Unix sockets, interpreter based execution (python scripts bypass binary restrictions), and newly created paths. 4. SELINUX BYPASS 4.1 Mode Check 4.2 Permissive Domain Exploitation 4.3 Context Transition & Booleans 5. SECCOMP BYPASS 5.1 Check Seccomp Status 5.2 Architecture Confusion (x86 vs x86 64) 5.3 Allowed Syscall Abuse & Kernel Bugs Allowed syscalls to abuse creatively: sendmsg/recvmsg (pass FDs between processes), mmap/mprotect (executable memory), process vm readv/writev (cross process memory). Known seccomp kernel bugs: CVE 2019 2054 (ptrace bypass), io uring bypassed seccomp entirely (pre 5.12). Check uname r and compare. 6. AUDIT EVASION 6.1 Timestamp Manipulation 6.2 Log Tampering & Process Spoofing 7. LINUX SECURITY BYPASS DECISION TREE

linux-security-bypass