#!/bin/sh
# DF-2759 end-to-end reproduction (run on the HOST; orchestrates the guest).
#
# Expected: the UNPRIVILEGED user's pty receives
#   (a) instantly:          MARKER1 (direct /dev/console forward via constty->t_dev)
#   (b) <=1s later:         <22>MARKER1 (constty_daemon msgbuf stream, syslog-pri tag)
#   (c) after unprivileged_read_msgbuf=0: dmesg fails with EPERM for the user
#       yet <22>MARKER2 still arrives on the pty  -> security knob bypass.
set -u
VM=./dfbsd-qemu/vm.sh
D=/tmp/df2759

echo '=== setup (root): workspace + restore msgbuf access default ==='
$VM run_root "sysctl -w security.unprivileged_read_msgbuf=1" || exit 1

echo '=== launch UNPRIVILEGED grabber in background (14s window) ==='
$VM run_user "cd $D && ./uconsole_grab 14 > user.log 2>&1" &
GRAB=$!

sleep 3
echo '=== root writes MARKER1 to /dev/console ==='
$VM run_root 'echo "DF2759-MARKER1-direct+daemon" > /dev/console'

sleep 3
echo '=== root locks the msgbuf against unprivileged readers ==='
$VM run_root 'sysctl -w security.unprivileged_read_msgbuf=0'
sleep 1
echo '=== unprivileged dmesg attempt (expected: EPERM) ==='
$VM run_user 'dmesg > /tmp/df2759/dmesg_attempt.log 2>&1; head -2 /tmp/df2759/dmesg_attempt.log; echo "dmesg exit: $?"'

echo '=== root writes MARKER2 (msgbuf locked for the user, pty stream still live) ==='
$VM run_root 'echo "DF2759-MARKER2-after-msgbuf-locked" > /dev/console'

echo '=== root triggers a pure kprintf path (module/network event, if available) ==='
$VM run_root 'ifconfig tap0 create 2>&1 || true; ifconfig tap1 destroy 2>/dev/null || true' || true

sleep 5
wait $GRAB
echo '=== unprivileged capture log ==='
$VM run_user "cat $D/user.log"
echo '=== cleanup (root): restore knob ==='
$VM run_root 'sysctl -w security.unprivileged_read_msgbuf=1'