1 /* This demonstrates races: kernel may actually open other file then
2 * you read at strace output. Create /tmp/delme with 10K of zeros and
3 * 666 mode, then run this under strace. If you see open successfull
4 * open of /etc/shadow, you know you've seen a race.
5 */
6
7 #include <stdio.h>
8 #include <stdlib.h>
9 #include <string.h>
10 #include <unistd.h>
11 #include <sys/mman.h>
12 #include <sys/types.h>
13 #include <sys/stat.h>
14 #include <fcntl.h>
15
main(int argc,char * argv[])16 int main(int argc, char *argv[])
17 {
18 char *c;
19 int fd;
20
21 fd = open("/tmp/delme", O_RDWR);
22 c = mmap(0, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
23 *c = 0;
24
25 if (fork()) {
26 while (1) {
27 strcpy(c, "/etc/passwd");
28 strcpy(c, "/etc/shadow");
29 }
30 } else {
31 while (1)
32 if ((fd = open(c, 0)) != -1)
33 close(fd);
34 }
35
36 return 0;
37 }
38