# DF-0022 — PoC

`PPS_IOC_KCBIND` missing privilege check in `pps_ioctl()`
(`sys/kern/kern_clock.c:1680-1694`).

## The bug

`pps_ioctl()` honors an unprivileged `PPS_IOC_KCBIND` that binds the kernel
`hardpps()` consumer (`pps->kcmode = kapi->edge` at `:1690`) with **no**
`caps_priv_check_self()`. The code carries an
`/* XXX Only root should be able to do this */` comment (`:1683`) acknowledging
the omission.

The entire KCBIND handler body is `#ifdef PPS_SYNC` (`:1681`). `options
PPS_SYNC` is **not** in the default `X86_64_GENERIC` kernel (only
`sys/config/LINT64:791`), so on the default GENERIC kernel the path is compiled
out (`#else return EOPNOTSUPP`). The bug is real for time-service kernels built
with `options PPS_SYNC`.

## Files

- **`kcbind.c`** — direct-open variant. Opens a PPS device and issues
  `PPS_IOC_KCBIND`. On a real PPS box with `/dev/pps0` (mode `0644`,
  `sys/dev/misc/pps/pps.c:103-104`), an unprivileged user can open it directly.
- **`kcbind_drop.c`** — **decisive** privilege-drop variant. Root opens the
  device, then drops to `uid=1001/gid=1001` before issuing the ioctl. Tests the
  ioctl privilege check independently of device-open permissions (needed on the
  KVM guest, whose only PPS device is the root-only console tty `/dev/ttyd0`).

## Build

```
cc -o kcbind kcbind.c
cc -o kcbind_drop kcbind_drop.c     # decisive
```

## Run

On a **PPS_SYNC** kernel, as root (the privilege-drop variant starts as root to
clear the open gate, then drops):

```
./kcbind_drop /dev/ttyd0
```

## Expected output

- **PPS_SYNC, no fix (bug present):**
  ```
  [*] now running as uid=1001 euid=1001 gid=1001
  [+] KCBIND succeeded under uid=1001 (privilege bypass) on /dev/ttyd0
  ```
- **PPS_SYNC + fix.diff (fixed):**
  ```
  [-] KCBIND rejected under uid=1001: Operation not permitted (errno=1)
  ```
- **Default GENERIC (no PPS_SYNC):** the KCBIND handler is compiled out; even
  with an openable PPS device the ioctl returns `EOPNOTSUPP`. The bug is latent.

See `VERDICT.md` for the full analysis and fix validation.