⬢ DragonFlyBSD Kernel Audit
DF-2815 / run.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
#!/bin/sh
# DF-2815 run — final validated recipes (root; destructive: reboots/panics)
#
# baseline : no churn -> clean dump ("Dumping ... Dump complete")
# race     : 4-thread DIOCGKERNELDUMP churn on the dump device + direct
#            reboot(2) RB_DUMP|RB_NOSYNC from a separate single-threaded
#            helper -> vulnerable kernel: Fatal trap 12 (VA 0xa8) at
#            dev_ddump+0xc mid-dump, panic.  patched kernel: Dump complete.
#
# NOTE (setup gotchas found the hard way):
#  - the churner MUST be a separate process (not threads of the reboot
#    caller) and MUST NOT write to any file/console once shutdown starts
#    (the root fs is force-unmounted; console goes polled) — otherwise the
#    churn threads freeze before the dump window;
#  - rebuild binaries on a normally-synced system: RB_NOSYNC reboots skip
#    sync/unmount and lose freshly written binaries on the dirty restart;
#  - run with debug.debugger_on_panic=0 + debug.trace_on_panic=1 so the
#    backtrace lands on the serial console and the box reboots itself.
#
# Run via:  dfbsd-qemu/vm.sh run_root 'sh /root/run.sh baseline'
#           dfbsd-qemu/vm.sh run_root 'sh /root/run.sh race'
case "$1" in
baseline)
	echo "=== BASELINE: rebootdirect only ==="
	sysctl debug.debugger_on_panic=0 debug.trace_on_panic=1 >/dev/null
	/root/rebootdirect
	;;
race)
	echo "=== RACE: churn mode3 + rebootdirect(RB_DUMP|RB_NOSYNC) ==="
	sysctl debug.debugger_on_panic=0 debug.trace_on_panic=1 >/dev/null
	nohup /root/churn /dev/vbd0s1b 900 3 4 >/dev/null 2>&1 &
	sleep 2
	/root/rebootdirect
	;;
*)
	echo "usage: $0 baseline|race" >&2
	exit 1
	;;
esac