dirtycow.sh

#!/bin/bash
#
# Copyright (c) 2018 Intel Corporation
#
# SPDX-License-Identifier: Apache-2.0
#

source "$(dirname $0)/lib.sh"

container_name="dirtycow"
runtime=${RUNTIME:-kata-runtime}
test_repo="https://github.com/dirtycow/dirtycow.github.io"
test_dir="/root/dirtycow"
test_file="$test_dir/test"
test_file_content="Hello"
dirty_file_content="pwned"

finish() {
	docker rm -f "$container_name"
}
trap finish EXIT

# Run a gcc container
docker run --runtime="$runtime" --name="$container_name" -dti gcc bash

# Turning off periodic writeback makes exploit stable
# This should fail inside a container
docker exec "$container_name" bash -c "echo 0 > /proc/sys/vm/dirty_writeback_centisecs"
[ $? == 0 ] && die "Turned off periodic writeback"

# Clone dirtycow repo
docker exec "$container_name" git clone "$test_repo" "$test_dir"

# Create and set as readonly the test file
docker exec "$container_name" bash -c "echo $test_file_content > $test_file; chmod 0404 $test_file"

# Build dirtycow
docker exec -w "$test_dir" "$container_name" gcc -pthread dirtyc0w.c -o dirtyc0w

# Run dirtycow
docker exec -w "$test_dir" "$container_name" ./dirtyc0w "$test_file" "$dirty_file_content"

# Check if test file was modified
docker exec -w "$test_dir" "$container_name" grep -q "$test_file_content" "$test_file"
[ $? == 1 ] && die "Modified read only file"

exit 0