#!/bin/sh
# DF-0851 run script
# Creates a valid ISO image, attaches it as a vnode device, then runs the PoC.
#
# Reachability note: cd9660 mount requires SYSCAP_RESTRICTEDROOT
# (sys/kern/vfs_syscalls.c:5397 get_fscap -> SYSCAP_RESTRICTEDROOT), so only
# root can reach iso_mountfs(). The threat model is root mounting an
# attacker-provided ISO image under heavy concurrent I/O.

set +e
DIR="$(cd "$(dirname "$0")" && pwd)"

echo "=== DF-0851 RUN SETUP ==="

# Create a valid ISO image
echo "[setup] Creating ISO image from /etc..."
rm -f /tmp/df0851.iso
makefs -t cd9660 /tmp/df0851.iso /etc >/dev/null 2>&1
if [ ! -f /tmp/df0851.iso ]; then
    echo "FATAL: could not create ISO image"
    exit 2
fi
echo "[setup] ISO image: $(ls -l /tmp/df0851.iso | awk '{print $5}') bytes"

# Attach as vnode device
echo "[setup] Attaching vnode device..."
vnconfig -u vn0 2>/dev/null
vnconfig -c vn0 /tmp/df0851.iso 2>&1
if [ ! -c /dev/vn0 ]; then
    echo "FATAL: vn0 not available"
    exit 2
fi

# Create mount points
for i in 0 1 2 3; do
    mkdir -p /tmp/df0851_mnt_$i
done

echo "=== RUNNING PoC (root; cd9660 requires RESTRICTEDROOT) ==="
cd "$DIR"
./poc 2>&1
RUN_RC=$?
echo "RUN_EXIT=$RUN_RC"

echo "=== CLEANUP ==="
for i in 0 1 2 3; do
    umount /tmp/df0851_mnt_$i 2>/dev/null
    rmdir /tmp/df0851_mnt_$i 2>/dev/null
done
vnconfig -u vn0 2>/dev/null
rm -f /tmp/df0851.iso

exit $RUN_RC