⬢ DragonFlyBSD Kernel Audit
DF-2648 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
{
  "finding_id": "DF-2648",
  "verdict": "reproduced",
  "impact": "none",
  "impact_detail": "Privilege-gate bypass demonstrated (unprivileged HAMMER2IOC_INODE_GET succeeds where gated ioctls return EPERM). Disclosed data is stat(2)-equivalent; hardening/consistency finding.",
  "reproduce": {
    "build": "guest: cc -O2 -o inodeget_user inodeget_user.c",
    "run": "root: mount image + chmod a+rx mountpoint; then: su -m nobody -c '/tmp/inodeget_user /mnt/h2'",
    "expected": "INODE_GET: SUCCESS (ungated!) ... / PFS_GET: errno=1 (Operation not permitted) -- gate works"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_ioctl.c:83",
    "sys/vfs/hammer2/hammer2_ioctl.c:86-88",
    "sys/vfs/hammer2/hammer2_ioctl.c:137-139",
    "sys/vfs/hammer2/hammer2_ioctl.c:968-982"
  ],
  "fix": "Honor caps_priv_check result for VERSION_GET and INODE_GET (if (error == 0) error = handler(...), matching every other gated case).",
  "artifacts": ["README.md", "inodeget_user.c", "run.log", "env.txt", "manifest.json", "verdict.json"]
}