glass beadian
aa5e262f3a
Self-hosted multi-platform broadcast newsroom for activist collectives: publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style column wall with hostile-content-safe rendering, live control room with Auto Director, bridged chat governance with polls and quorum, distributed sandboxed transcode workers, encrypted content-addressed archive, monthly analytics. MIT licensed. See README.md and docs/.
77 lines
3.7 KiB
C
77 lines
3.7 KiB
C
/* Adversarial test payload, compiled statically into the disposable test rootfs. */
|
|
#define _GNU_SOURCE
|
|
#include <arpa/inet.h>
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <sys/prctl.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/wait.h>
|
|
#include <unistd.h>
|
|
extern char **environ;
|
|
static void copy(const char *path) {
|
|
FILE *f = fopen(path, "r"); if (!f) exit(9);
|
|
int c; while ((c = fgetc(f)) != EOF) putchar(c ? c : '\n'); fclose(f);
|
|
}
|
|
int main(int argc, char **argv) {
|
|
const char *input = NULL;
|
|
for (int i = 1; i + 1 < argc; i++) if (!strcmp(argv[i], "-i")) input = argv[i + 1];
|
|
if (!input || strncmp(input, "file:", 5)) {
|
|
/* Pipe-only supervisor canary: stay alive to inspect /proc, then force a failure. */
|
|
fputs("forced authentication/connection failure\n", stderr); fflush(stderr); sleep(2); return 7;
|
|
}
|
|
FILE *f = fopen(input + 5, "r"); if (!f) return 8;
|
|
char action[64], path[4096] = {0};
|
|
if (!fgets(action, sizeof(action), f)) return 8;
|
|
action[strcspn(action, "\n")] = 0;
|
|
if (fgets(path, sizeof(path), f)) path[strcspn(path, "\n")] = 0;
|
|
fclose(f);
|
|
if (!strcmp(action, "isolation")) {
|
|
if (!getuid() || prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) return 10;
|
|
if (!access(path, R_OK) || !access("/etc/passwd", R_OK) || !access("/var/run/docker.sock", R_OK)) return 11;
|
|
int fd = open("/root-write", O_WRONLY|O_CREAT, 0600); if (fd >= 0) return 12;
|
|
fd = open("/scratch/result", O_WRONLY|O_CREAT, 0600); if (fd < 0) return 13; close(fd);
|
|
if (!access("/upload/unmounted", R_OK)) return 14;
|
|
printf("isolated uid=%u\n", getuid()); return 0;
|
|
}
|
|
if (!strcmp(action, "network")) {
|
|
for (int n = 0; n < 3; n++) {
|
|
int fd = socket(AF_INET, SOCK_STREAM, 0);
|
|
if (fd >= 0) {
|
|
const char *ips[] = {"127.0.0.1", "10.0.0.1", "169.254.169.254"};
|
|
struct sockaddr_in addr = { .sin_family = AF_INET, .sin_port = htons(80) };
|
|
inet_pton(AF_INET, ips[n], &addr.sin_addr);
|
|
if (!connect(fd, (struct sockaddr *)&addr, sizeof(addr))) return 15;
|
|
close(fd);
|
|
} else if (errno != EPERM) return 16;
|
|
}
|
|
puts("network denied"); return 0;
|
|
}
|
|
if (!strcmp(action, "memory")) {
|
|
puts("ready"); fflush(stdout);
|
|
for (;;) { char *p = malloc(1024*1024); if (!p) return 17; memset(p, 1, 1024*1024); asm volatile("" : : "r"(p) : "memory"); }
|
|
}
|
|
if (!strcmp(action, "pids")) {
|
|
int count = 0; pid_t child;
|
|
while ((child = fork()) >= 0) { if (!child) { sleep(10); return 0; } if (++count > 100) return 18; }
|
|
puts("pids denied"); fflush(stdout);
|
|
int ok = errno == EAGAIN; return ok ? 0 : 19;
|
|
}
|
|
if (!strcmp(action, "sleep")) { puts("ready"); fflush(stdout); sleep(20); return 0; }
|
|
if (!strcmp(action, "size")) {
|
|
f = fopen("/scratch/large", "w"); if (!f) return 20;
|
|
for (;;) { char b[4096] = {0}; if (fwrite(b, 1, sizeof(b), f) != sizeof(b)) return 21; fflush(f); }
|
|
}
|
|
if (!strcmp(action, "metadata")) {
|
|
copy("/proc/self/cmdline"); copy("/proc/self/environ");
|
|
/* Host canaries must not be visible to the child. */
|
|
for (char **e = environ; *e; e++) if (strstr(*e, "CANARY")) return 22;
|
|
fputs("forced authentication/connection failure\n", stderr); sleep(2); return 7;
|
|
}
|
|
if (!strcmp(action, "probe-good")) { puts("{\"format\":{\"format_name\":\"wav\",\"duration\":\"1.0\",\"size\":\"10\"},\"streams\":[{\"index\":0,\"codec_type\":\"audio\",\"codec_name\":\"pcm_s16le\",\"sample_rate\":\"48000\",\"channels\":2}]}"); return 0; }
|
|
if (!strcmp(action, "probe-big")) { for (int i = 0; i < 500000; i++) putchar('x'); return 0; }
|
|
puts("{\"format\":{},\"streams\":[],\"unexpected\":\"untrusted metadata\"}"); return 0;
|
|
}
|