⬢ DragonFlyBSD Kernel Audit
DF-5655 / as_nobody.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
/* DF-5655: drop to in-vkernel uid/gid 65534 (nobody) then exec the target.
 * Proves the trigger needs no privilege INSIDE the vkernel — the boundary
 * being tested is the vkernel->host kernel boundary. */
#include <unistd.h>

int
main(int argc, char **argv)
{
	if (argc < 2) {
		write(2, "usage: as_nobody prog [args...]\n", 32);
		return (2);
	}
	if (setgid(65534) != 0 || setuid(65534) != 0) {
		write(2, "as_nobody: setuid failed\n", 25);
		return (3);
	}
	execv(argv[1], argv + 1);
	write(2, "as_nobody: exec failed\n", 23);
	return (127);
}