DragonFlyBSD Kernel Audit
DF-2940 / watch.sh
← back to finding ↓ download raw
1
2
3
4
5
6
7
8
9
#!/bin/sh
# DF-2940 — capture evidence of the violation (run alongside trigger.sh)
# watchdog: snapshots the mpipe state from dmesg and the process table.
: > /root/poc/violations.txt
while :; do
    dmesg 2>/dev/null | grep -E "dmtc_destroy|mpipe_done: enter" >> /root/poc/violations.txt
    ps ax -o stat,wchan,command 2>/dev/null | grep -E "^.. *D.*(dmtbl|waitmsg)" >> /root/poc/wedge_ps.txt
    sleep 2
done