DragonFlyBSD Kernel Audit
DF-2765 / df2765_run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2765: journal_nrename records post-rename namecache paths.
# 1) build tree BEFORE journal install (so no CREATE records pollute stream)
rm -rf /tmp/jt /root/jr.bin
mkdir -p /tmp/jt/a /tmp/jt/b
echo hello > /tmp/jt/a/src.txt
# 2) install journal on /tmp writing to /root (different fs)
mountctl -a -w /root/jr.bin -o memfifo=64k /tmp:rename1 || exit 2
sleep 1
mountctl -l /tmp
# 3) the rename (root; through the journal shim)
mv /tmp/jt/a/src.txt /tmp/jt/b/dst.txt
sleep 2
# 4) remove journal -> final flush (DISASSOCIATE record)
mountctl -d /tmp:rename1
sleep 2
ls -l /root/jr.bin
cp /root/jr.bin /tmp/jr_sample.bin && chmod 644 /tmp/jr_sample.bin
echo "== strings in stream =="
strings -a /root/jr.bin | grep -E 'jt/|src|dst' || echo "(no path strings found)"
echo "== base64 =="
base64 /root/jr.bin