# DF-2793 VERDICT

**Finding:** `sys_rtprio()` and `sys_lwp_rtprio()` omit `PRISON_CHECK`
entirely (sys/kern/kern_resource.c:582-601 / 701-704), breaking the jail
confinement that every other priority syscall in the same file enforces.

**Status: REPRODUCED. Severity Low (cross-jail information leak).**

## Root cause

* `PRISON_CHECK(cr1, cr2)` (sys/sys/proc.h:462) is DragonFly's jail
  visibility test: `(!(cr1)->cr_prison || (cr1)->cr_prison ==
  (cr2)->cr_prison)` — a jailed cred must only see same-prison procs.
* getpriority (:104, :123), setpriority (:208, :233, :277), ioprio_get
  (:347, :366), ioprio_set (:450, :475, :520) all apply it around every
  `p->p_ucred` dereference of a target proc. `sys_rtprio` and
  `sys_lwp_rtprio` apply it **nowhere**.
* `sys_rtprio`'s RTP_LOOKUP additionally has no uid-ownership check
  before the copyout, and the RTP_SET ownership gate (:711-716) treats
  `cr_uid == 0` as privileged, which jailed root satisfies. Result:
  jailed root can enumerate/read rtprio of arbitrary host processes;
  a jailed user can read host processes whose euid matches their uid.
* Write-side containment (verified by inspection): for non-NOSCHED
  callers the `if (uap->pid)` EPERM at :720-723 (and :622-625) blocks
  cross-pid RTP_SET; jailed root lacks SYSCAP_NOSCHED (kern_jail.c:857-
  869 denies group-5 caps in jails). So the reachable defect is
  read-only: scheduling class + priority of foreign-jail processes.

## Run

Guest dfbsd 6.5-DEVELOPMENT X86_64_GENERIC, as root:

* Child jails itself (jail(2), which in DF creates AND attaches —
  kern_jail.c:227) with path /tmp/jail2793.
* From inside the jail (still uid 0, cred->cr_prison = new sub-jail):
  * `rtprio(RTP_LOOKUP, parent_pid)` → **OK, type=1 prio=7** — the exact
    value the host parent had set for itself → real data crossed the
    boundary.
  * `getpriority(PRIO_PROCESS, parent_pid)` → **ESRH** (prison check
    present) — same file, same target, different syscall.
  * `setpriority(...)` → ESRCH likewise.
  * `rtprio(RTP_LOOKUP, 1)` → OK — init's rtprio readable from jail.
* Reproduced on both kernel #0 and the DF-2791-patched kernel #1.

## Impact ceiling

Cross-jail confidentiality leak of scheduling metadata (rtprio class and
priority) for all host/foreign-jail processes readable by jailed root,
or by any jailed user where uids collide (common: uid 1001 in a jail and
on the host). Value is host-process metadata, not kernel memory. Low
severity; requires jails to be deployed.

## Fix validation

fix.diff adds `PRISON_CHECK(curthread->td_ucred, p->p_ucred)` → ESRCH to
both syscalls. Not rebuilt (Low, read-path only, mirrors five existing
call sites in the same file) — fix_status: not_testable.