⬢ DragonFlyBSD Kernel Audit
DF-0165 / manifest.json
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
{
  "finding_id": "DF-0165",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "b9a306d0f9e7f73e4c245b4cc038294a3be6c13dd327ab55b89b5a9764a94a47",
  "tested_at": "2026-07-22T18:10:00Z",
  "verdict": "REPRODUCED + FIX VALIDATED",
  "impact": "jail-policy bypass (raw sockets + tmpfs/nullfs/devfs/procfs mounts in default-policy jail)",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "bug manifests; see run.log / VERDICT.md. On a fixed kernel: no effect."
  },
  "fix_validation": {
    "status": "fixed",
    "baseline_kernel": "DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026",
    "patched_kernel": "DragonFly 6.5-DEVELOPMENT #1: Thu Jul  2 11:16:47 UTC 2026",
    "patched_kernel_sha256": "9213f61534131ee4720f0eeaa04a588c64b881e94a63fb6185671cebf9fde92b",
    "baseline_bypass_count": 5,
    "patched_bypass_count": 0
  },
  "kernel_refs": [
    "sys/kern/kern_caps.c:333",
    "sys/kern/kern_caps.c:334",
    "sys/kern/kern_caps.c:335",
    "sys/kern/kern_caps.c:340",
    "sys/kern/kern_jail.c:851",
    "sys/kern/kern_jail.c:854",
    "sys/kern/kern_jail.c:865",
    "sys/kern/kern_jail.c:866",
    "sys/kern/kern_jail.c:872",
    "sys/kern/kern_jail.c:878",
    "sys/kern/kern_jail.c:919",
    "sys/kern/kern_jail.c:923",
    "sys/kern/kern_jail.c:951",
    "sys/kern/kern_jail.c:956",
    "sys/kern/kern_jail.c:961",
    "sys/kern/kern_jail.c:966",
    "sys/kern/kern_jail.c:971",
    "sys/netinet/raw_ip.c:473",
    "sys/kern/vfs_syscalls.c:152",
    "sys/kern/vfs_syscalls.c:157",
    "sys/sys/caps.h:116",
    "sys/sys/caps.h:117",
    "sys/sys/caps.h:137",
    "sys/sys/caps.h:141",
    "sys/sys/caps.h:196",
    "sys/sys/caps.h:223",
    "sys/sys/caps.h:228"
  ],
  "artifacts": [
    {
      "path": "bypass.c",
      "type": "trigger-source",
      "desc": "self-contained jail-create + gated-action driver; proves cap-corruption bypass"
    },
    {
      "path": "build.sh",
      "type": "build-script",
      "desc": "cc -O2 -Wall -o bypass bypass.c"
    },
    {
      "path": "run.sh",
      "type": "run-script",
      "desc": "echoes jail default-policy sysctls then runs ./bypass"
    },
    {
      "path": "build.log",
      "type": "build-log",
      "desc": "final successful PoC build, full output"
    },
    {
      "path": "run.log",
      "type": "run-log",
      "desc": "decisive baseline run on #0: 5 bypasses observed"
    },
    {
      "path": "run.2.log",
      "type": "run-log",
      "desc": "repeat baseline run for reproducibility"
    },
    {
      "path": "run.3.log",
      "type": "run-log",
      "desc": "third baseline run for reproducibility"
    },
    {
      "path": "fix_baseline.log",
      "type": "fix-baseline-log",
      "desc": "PoC on UNPATCHED #0 kernel: 5 cap-gated actions bypass jail policy"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "git-apply-able fix: introduce gcap local in caps_priv_check, pass original cap to prison_priv_check"
    },
    {
      "path": "fix_notes.md",
      "type": "fix-notes",
      "desc": "post-verification fix rationale and correctness argument"
    },
    {
      "path": "fix_build.log",
      "type": "fix-build-log",
      "desc": "full nativekernel build of single-fix #1 kernel (NK_DONE rc=0)"
    },
    {
      "path": "fix_run.log",
      "type": "fix-run-log",
      "desc": "PoC on PATCHED #1 kernel: all 5 actions EPERM (policy enforced)"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "uname for both #0 and #1 kernels, cc version, jail default policy, patched kernel sha256"
    },
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full narrative + line-by-line kernel trace + recommended fix + fix-validation section"
    },
    {
      "path": "README.md",
      "type": "readme",
      "desc": "what this pack is and how to reproduce"
    },
    {
      "path": "manifest.json",
      "type": "manifest",
      "desc": "this file"
    },
    {
      "path": "fix_apply.log",
      "type": "apply-log",
      "desc": "patch --dry-run output proving fix.diff applies cleanly on with-src"
    },
    {
      "path": "../fix_build_combined.log",
      "type": "build-log",
      "desc": "Combined 41-finding kernel build (rc=0, -Werror clean)"
    },
    {
      "path": "../fix_build_summary.txt",
      "type": "build-summary",
      "desc": "Summary of the combined 41-finding kernel build"
    }
  ]
}