⬢ DragonFlyBSD Kernel Audit
DF-2314 / prep.sh
← back to finding ↓ download raw
#!/bin/sh
# prep.sh -- one-time guest preparation for the pnp.c rig (DF-2314/DF-2315).
# Files are pushed to /root/pnp from the host.  The guest's /usr/src is the
# build scratch; the host-side sys/ tree is never modified.
set -e
cd /root/pnp

# 0. VERBATIM GATE: the guest's pnp.c must be byte-identical to the audited
#    tree (pristine sha256).  Refuse to prep a patched tree.
PRISTINE=2ba5773dab35234162ad021ddc35140ae2c4cb202bd10ef7a678dff56ed38d40
GOT=$(sha256 -r /usr/src/sys/bus/isa/pnp.c | awk '{print $1}')
if [ "$GOT" != "$PRISTINE" ]; then
	if [ "${PNPH_ALLOW_PATCHED:-0}" = 1 ]; then
		echo "VERBATIM_CHECK pnp.c PATCHED $GOT (pristine=$PRISTINE) -- allowed"
	else
		echo "VERBATIM_CHECK pnp.c PATCHED $GOT (pristine=$PRISTINE) -- REFUSING"
		exit 3
	fi
else
	echo "VERBATIM_CHECK pnp.c PRISTINE $GOT"
fi

# 1. install the harness into the kernel tree; drop the stock pnp.c unit
#    (its TU is compiled inside pnp_harness.c) and register ours.
install -m 644 pnp_harness.c pnph.h /usr/src/sys/bus/isa/
grep -q 'pnp.c.*optional pnp_stock_disabled' /usr/src/sys/conf/files || \
sed -e 's#^bus/isa/pnp\.c[[:space:]].*#bus/isa/pnp.c			optional pnp_stock_disabled#' \
    /usr/src/sys/conf/files > /tmp/files.new && mv /tmp/files.new /usr/src/sys/conf/files
grep -q pnp_harness.c /usr/src/sys/conf/files || \
    printf 'bus/isa/pnp_harness.c		optional pnp_harness\n' \
        >> /usr/src/sys/conf/files
grep -n 'bus/isa/pnp' /usr/src/sys/conf/files

# 2. kernel config: stock generic + the harness device
if [ ! -f /usr/src/sys/config/PNPH ]; then
	cp /usr/src/sys/config/X86_64_GENERIC /usr/src/sys/config/PNPH
	printf '\n# pnp.c audit rig (DF-2314/DF-2315)\ndevice\t\tpnp_harness\n' \
	    >> /usr/src/sys/config/PNPH
fi

# 3. panic behavior: no ddb
grep -q debugger_on_panic /etc/sysctl.conf || \
    echo 'debug.debugger_on_panic=0' >> /etc/sysctl.conf
sysctl debug.debugger_on_panic=0

# 4. build the userland trigger
cc -O -Wall -o pnphctl pnphctl.c
ls -l pnphctl
echo PREP_OK