DF-0181 / run.sh
#!/bin/sh # DF-0181 — driver: invokes df0181_trigger (self-contained). # Run as root (host root). # - trigger forks helper (host root) # - parent jail(2) attaches to new jail # - helper clears jail.<jid>.sys_set_hostname=0 from outside # - parent (jailed) issues sysctl -w kern.hostname=evil -> EPERM -> leaks XLOCK # - helper probes host sysctl with 5s alarm set -u cd "$(dirname "$0")" ./df0181_trigger |