1 /* This demonstrates races: kernel may actually open other file then 2 * you read at strace output. Create /tmp/delme with 10K of zeros and 3 * 666 mode, then run this under strace. If you see open successfull 4 * open of /etc/shadow, you know you've seen a race. 5 */ 6 7 #include <stdio.h> 8 #include <stdlib.h> 9 #include <string.h> 10 #include <unistd.h> 11 #include <sys/mman.h> 12 #include <sys/types.h> 13 #include <sys/stat.h> 14 #include <fcntl.h> 15 16 int main(int argc, char *argv[]) 17 { 18 char *c; 19 int fd; 20 21 fd = open("/tmp/delme", O_RDWR); 22 c = mmap(0, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); 23 *c = 0; 24 25 if (fork()) { 26 while (1) { 27 strcpy(c, "/etc/passwd"); 28 strcpy(c, "/etc/shadow"); 29 } 30 } else { 31 while (1) 32 if ((fd = open(c, 0)) != -1) 33 close(fd); 34 } 35 36 return 0; 37 } 38
