1/* This demonstrates races: kernel may actually open other file then
2 * you read at strace output. Create /tmp/delme with 10K of zeros and
3 * 666 mode, then run this under strace. If you see open successfull
4 * open of /etc/shadow, you know you've seen a race.
5 */
6
7#include <stdio.h>
8#include <stdlib.h>
9#include <string.h>
10#include <unistd.h>
11#include <sys/mman.h>
12#include <sys/types.h>
13#include <sys/stat.h>
14#include <fcntl.h>
15
16int main(int argc, char *argv[])
17{
18	char *c;
19	int fd;
20
21	fd = open("/tmp/delme", O_RDWR);
22	c = mmap(0, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
23	*c = 0;
24
25	if (fork()) {
26		while (1) {
27			strcpy(c, "/etc/passwd");
28			strcpy(c, "/etc/shadow");
29		}
30	} else {
31		while (1)
32			if ((fd = open(c, 0)) != -1)
33				close(fd);
34	}
35
36	return 0;
37}
38