# DF-2874 — DIOCRECLUSTER: no privilege check; kernel opens the raw disk
# FREAD|FWRITE with proc0.p_ucred on the dmsg peer's request (Info —
# mitigated by diskopen's SYSCAP_RESTRICTEDROOT gate)

## What this pack contains

- `dfpeer.c` — dmsg wire peer; `openwr` mode issues BLK_OPEN(RD|WR) and
  prints the kernel's reply (`error=0` = dev_dopen(rawdev, FREAD|FWRITE,
  S_IFCHR, proc0.p_ucred, ...) succeeded).
- `run_f1.sh` — full chain attempt as an unprivileged operator-group user.
- `run_f1b.sh` — the chain at the dmsg-peer position (root harness):
  BLK_OPEN(RD|WR) → raw write through the channel → root dd readback
  shows the payload on the raw disk.

## Outcome

- **Peer position (verified):** `BLK_OPEN modes=3 -> reply error=0`; a
  4KB 0x5a write at gap offset 0x77F000000 lands on the raw disk
  (confirmed by root dd md5) and reads back through the channel.
- **Unprivileged position (blocked):** a member of group operator cannot
  even open /dev/vbd0 read-only — `diskopen()` (sys/kern/subr_disk.c:78-80)
  enforces `caps_priv_check_self(SYSCAP_RESTRICTEDROOT)` on every disk
  volume open, so the ioctl path is effectively root-only on this system.
  The missing `priv_check` in `diskioctl()`/`disk_iocom_ioctl()` is
  therefore a defense-in-depth gap (the 0640 root:operator node perms and
  the absence of any FWRITE-on-node requirement would otherwise let an
  operator-group user turn read-only device access into kernel-mediated
  root-credential raw disk R/W).
- Also demonstrated: `disk_blk_write`/`disk_blk_read` perform raw I/O with
  **no BLK_OPEN/keyid validation at all** — every message the iocom
  receives is executed with root credentials.

## fix.diff

Require FWRITE on the device node for DIOCRECLUSTER (devfs then enforces
write permission at open time), making the gate explicit instead of
incidental.