DF-3023 / build.sh
#!/bin/sh # DF-3023 evidence pack build/run # build: cc -O2 -o df3023 trigger.c # run (as unprivileged user on the guest, /tmp is tmpfs): # ./df3023 -> probe (EFAULT) + kernel PANIC on INVARIANTS kernels # success criterion: console shows # panic: assertion "newsize >= 0" failed in tmpfs_reg_resize # at /usr/src/sys/vfs/tmpfs/tmpfs_subr.c:990 # (guest drops to db>; ssh dies; vm.sh status => down) set -e cc -O2 -o df3023 trigger.c echo "built; run me as an unprivileged user on a system with a tmpfs /tmp" |