FLAG_CAPTURED(9)

NAME
flag_captured - Demostrate arbitrary code executation in the kernel

LIBRARY
libc

SYNOPSIS
#define FLAG_CAPURED_KEY 0xfe77c0de
int
flag_captured(const char *message, uint32_t key);

DESCRIPTION
The flag_captured() function is intended to provide capture-the-flag participants and red team members a (mostly-)harmless way to demonstrating arbitrary code execution. When called, flag_captured() logs a message indicated the process and user of the thread that called it and increments the counter reported by the security.kernel_flags_captured sysctl MIB entry. The message argument is an optional message to be logged along with notice that the syscall has been called. If the key argument is set to 0xfe77c0de then the log will indicate that the correct key was used and the counter reported by the security.kernel_flags_captured_key sysctl MIB entry will be incremented.

Note that if message is sufficiently invalid, the logging code may crash the kernel.

HISTORY
The flag_captured() function was first implemented CheriBSD to support the DARPA FETT bug bounty.

AUTHORS
This software and this manual page were developed by SRI International and the University of Cambridge Computer Laboratory (Department of Computer Science and Technology) under contract (HR0011-18-C-0016) (“ECATS”), as part of the DARPA SSITH research programme.

SEE ALSO
sysctl(2)