⬢ DragonFlyBSD Kernel Audit
DF-3154 / run_baseline.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
#!/bin/sh
# DF-3154 baseline, contamination-free layout:
#   - one vn unit per image (buffer-cache identities stay separate)
#   - ALL mounts happen BEFORE any stat (failed vget poisons umount:
#     stock kernel panics in ext2_reclaim/vrele on unmount afterwards)
#   - stat order: A_zero (suppression expected) -> B x2 (heap-decided)
#                 -> A_nonzero (deterministic EIO) LAST
#   - final umount -f of the poisoned mount: expected stock panic
#     (evidence for the ext2_vget error-path refcount note)
set -u
kldload ext2fs 2>/dev/null || true
for m in a z b1 b2; do mkdir -p /mnt/e2$m; done
for u in 0 1 2 3; do vnconfig -u vn$u >/dev/null 2>&1; done

vnconfig -c vn0 /root/df3154.A_nonzero.ext2 >/dev/null
vnconfig -c vn1 /root/df3154.A_zero.ext2    >/dev/null
vnconfig -c vn2 /root/df3154.B.ext2         >/dev/null
vnconfig -c vn3 /root/df3154.B.ext2         >/dev/null

mount -t ext2fs -o ro /dev/vn0 /mnt/e2a
mount -t ext2fs -o ro /dev/vn1 /mnt/e2z
mount -t ext2fs -o ro /dev/vn2 /mnt/e2b1
mount -t ext2fs -o ro /dev/vn3 /mnt/e2b2
chmod 755 /mnt/e2a /mnt/e2z /mnt/e2b1 /mnt/e2b2

echo "=== sanity: untouched inode reads ==="
printf 'stat f00 on A_zero img : '
su maxx -c "stat -f 'OK %N ino=%i mode=%Sp' /mnt/e2z/f00" 2>&1 || true
printf 'ls A_zero img          : '
ls /mnt/e2z 2>/dev/null | wc -l

echo "=== case A_zero (neighbor slot zeroed -> memcmp==0 -> suppressed) ==="
printf 'stat f03 on A_zero     : '
su maxx -c "stat -f 'OK %N ino=%i mode=%Sp' /mnt/e2z/f03" 2>&1 || true

echo "=== case B x2 (last-in-block slot -> 32 kernel-heap bytes decide) ==="
printf 'stat f12 on B (vn2)    : '
su maxx -c "stat -f 'OK %N ino=%i mode=%Sp' /mnt/e2b1/f12" 2>&1 || true
printf 'stat f12 on B (vn3)    : '
su maxx -c "stat -f 'OK %N ino=%i mode=%Sp' /mnt/e2b2/f12" 2>&1 || true

echo "=== case A_nonzero (neighbor slot 0xAA.. -> memcmp!=0 -> EIO) ==="
printf 'stat f03 on A_nonzero  : '
su maxx -c "stat -f 'OK %N ino=%i mode=%Sp' /mnt/e2a/f03" 2>&1 || true

echo "=== expected stock panic on umount of the poisoned mount ==="
umount -f /mnt/e2a 2>&1 || echo "umount rc=$? (no panic)"
echo SCRIPT-DONE