1/* This demonstrates races: kernel may actually open other file then 2 * you read at strace output. Create /tmp/delme with 10K of zeros and 3 * 666 mode, then run this under strace. If you see open successfull 4 * open of /etc/shadow, you know you've seen a race. 5 */ 6 7#include <stdio.h> 8#include <stdlib.h> 9#include <string.h> 10#include <unistd.h> 11#include <sys/mman.h> 12#include <sys/types.h> 13#include <sys/stat.h> 14#include <fcntl.h> 15 16int main(int argc, char *argv[]) 17{ 18 char *c; 19 int fd; 20 21 fd = open("/tmp/delme", O_RDWR); 22 c = mmap(0, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); 23 *c = 0; 24 25 if (fork()) { 26 while (1) { 27 strcpy(c, "/etc/passwd"); 28 strcpy(c, "/etc/shadow"); 29 } 30 } else { 31 while (1) 32 if ((fd = open(c, 0)) != -1) 33 close(fd); 34 } 35 36 return 0; 37} 38