#!/bin/sh
# DF-2950 fix validation on patched kernel:
# jailed uid-0 writes to host-global MIBs must now fail EPERM;
# host root writes must still work; jail hostname READ must still work.
set -x
date; uname -a; sysctl kern.securelevel kern.hostid kern.domainname

echo '=== [F1] jailed uid-0 tries to raise HOST kern.securelevel ==='
jail / df2950fa 127.0.0.4 /bin/sh -c 'id; sysctl -w kern.securelevel=1'
echo "rc=$? (expect non-zero/EPERM)"
sysctl kern.securelevel

echo '=== [F2] jailed uid-0 tries hostid/domainname/maxposixlocks ==='
jail / df2950fb 127.0.0.4 /bin/sh -c 'sysctl -w kern.hostid=4242; sysctl -w kern.domainname=pwned; sysctl -w kern.maxposixlocksperuid=1'
echo "rc=$?"
sysctl kern.hostid kern.domainname kern.maxposixlocksperuid

echo '=== [F3] jailed hostname READ still works (prison-scoped) ==='
jail / df2950fc 127.0.0.4 /bin/sh -c 'hostname'

echo '=== [F4] HOST root can still write (not over-restricted) ==='
sysctl -w kern.hostid=99
sysctl kern.hostid
date
echo FIXTEST-DONE