/* Adversarial test payload, compiled statically into the disposable test rootfs. */
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <unistd.h>
extern char **environ;
static void copy(const char *path) {
  FILE *f = fopen(path, "r"); if (!f) exit(9);
  int c; while ((c = fgetc(f)) != EOF) putchar(c ? c : '\n'); fclose(f);
}
int main(int argc, char **argv) {
  const char *input = NULL;
  for (int i = 1; i + 1 < argc; i++) if (!strcmp(argv[i], "-i")) input = argv[i + 1];
  if (!input || strncmp(input, "file:", 5)) {
    /* Pipe-only supervisor canary: stay alive to inspect /proc, then force a failure. */
    fputs("forced authentication/connection failure\n", stderr); fflush(stderr); sleep(2); return 7;
  }
  FILE *f = fopen(input + 5, "r"); if (!f) return 8;
  char action[64], path[4096] = {0};
  if (!fgets(action, sizeof(action), f)) return 8;
  action[strcspn(action, "\n")] = 0;
  if (fgets(path, sizeof(path), f)) path[strcspn(path, "\n")] = 0;
  fclose(f);
  if (!strcmp(action, "isolation")) {
    if (!getuid() || prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) return 10;
    if (!access(path, R_OK) || !access("/etc/passwd", R_OK) || !access("/var/run/docker.sock", R_OK)) return 11;
    int fd = open("/root-write", O_WRONLY|O_CREAT, 0600); if (fd >= 0) return 12;
    fd = open("/scratch/result", O_WRONLY|O_CREAT, 0600); if (fd < 0) return 13; close(fd);
    if (!access("/upload/unmounted", R_OK)) return 14;
    printf("isolated uid=%u\n", getuid()); return 0;
  }
  if (!strcmp(action, "network")) {
    for (int n = 0; n < 3; n++) {
      int fd = socket(AF_INET, SOCK_STREAM, 0);
      if (fd >= 0) {
        const char *ips[] = {"127.0.0.1", "10.0.0.1", "169.254.169.254"};
        struct sockaddr_in addr = { .sin_family = AF_INET, .sin_port = htons(80) };
        inet_pton(AF_INET, ips[n], &addr.sin_addr);
        if (!connect(fd, (struct sockaddr *)&addr, sizeof(addr))) return 15;
        close(fd);
      } else if (errno != EPERM) return 16;
    }
    puts("network denied"); return 0;
  }
  if (!strcmp(action, "memory")) {
    puts("ready"); fflush(stdout);
    for (;;) { char *p = malloc(1024*1024); if (!p) return 17; memset(p, 1, 1024*1024); asm volatile("" : : "r"(p) : "memory"); }
  }
  if (!strcmp(action, "pids")) {
    int count = 0; pid_t child;
    while ((child = fork()) >= 0) { if (!child) { sleep(10); return 0; } if (++count > 100) return 18; }
    puts("pids denied"); fflush(stdout);
    int ok = errno == EAGAIN; return ok ? 0 : 19;
  }
  if (!strcmp(action, "sleep")) { puts("ready"); fflush(stdout); sleep(20); return 0; }
  if (!strcmp(action, "size")) {
    f = fopen("/scratch/large", "w"); if (!f) return 20;
    for (;;) { char b[4096] = {0}; if (fwrite(b, 1, sizeof(b), f) != sizeof(b)) return 21; fflush(f); }
  }
  if (!strcmp(action, "metadata")) {
    copy("/proc/self/cmdline"); copy("/proc/self/environ");
    /* Host canaries must not be visible to the child. */
    for (char **e = environ; *e; e++) if (strstr(*e, "CANARY")) return 22;
    fputs("forced authentication/connection failure\n", stderr); sleep(2); return 7;
  }
  if (!strcmp(action, "probe-good")) { puts("{\"format\":{\"format_name\":\"wav\",\"duration\":\"1.0\",\"size\":\"10\"},\"streams\":[{\"index\":0,\"codec_type\":\"audio\",\"codec_name\":\"pcm_s16le\",\"sample_rate\":\"48000\",\"channels\":2}]}"); return 0; }
  if (!strcmp(action, "probe-big")) { for (int i = 0; i < 500000; i++) putchar('x'); return 0; }
  puts("{\"format\":{},\"streams\":[],\"unexpected\":\"untrusted metadata\"}"); return 0;
}