#!/bin/sh
# DF-0022 run script.
#
# This finding requires a kernel built with 'options PPS_SYNC' (the KCBIND
# handler is #ifdef'd out on the default GENERIC kernel — see VERDICT.md).
# On the default kernel this script reports the bug is latent/unreachable.
#
# The decisive test is kcbind_drop: root opens /dev/ttyd0 (clearing the
# console-tty open gate), drops to uid=1001, then issues PPS_IOC_KCBIND.
#   bug present (PPS_SYNC, no fix): KCBIND succeeds under uid=1001
#   fixed       (PPS_SYNC + fix) : KCBIND returns EPERM (errno=1)
#
# Must be run as root (the open+drop is a root-started, unprivileged-cred test).
set -e
cd "$(dirname "$0")"
DEV="${1:-/dev/ttyd0}"
echo "=== kern.version ==="
sysctl -n kern.version | head -1
echo "=== privilege-drop KCBIND test on $DEV ==="
./kcbind_drop "$DEV"
echo "rc=$?"