+ date
Fri Sep  4 00:25:04 UTC 2026
+ uname -a
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Fri Sep  4 00:17:28 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
+ sysctl kern.securelevel kern.hostid kern.domainname
kern.securelevel: -1
kern.hostid: 0
kern.domainname: 
=== [F1] jailed uid-0 tries to raise HOST kern.securelevel ===
+ echo '=== [F1] jailed uid-0 tries to raise HOST kern.securelevel ==='
+ jail / df2950fa 127.0.0.4 /bin/sh -c 'id; sysctl -w kern.securelevel=1'
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
sysctl: sysctlnametomib("kern.securelevel"): Operation not permitted
rc=1 (expect non-zero/EPERM)
+ echo 'rc=1 (expect non-zero/EPERM)'
+ sysctl kern.securelevel
kern.securelevel: -1
=== [F2] jailed uid-0 tries hostid/domainname/maxposixlocks ===
+ echo '=== [F2] jailed uid-0 tries hostid/domainname/maxposixlocks ==='
+ jail / df2950fb 127.0.0.4 /bin/sh -c 'sysctl -w kern.hostid=4242; sysctl -w kern.domainname=pwned; sysctl -w kern.maxposixlocksperuid=1'
sysctl: sysctlnametomib("kern.hostid"): Operation not permitted
sysctl: sysctlnametomib("kern.domainname"): Operation not permitted
sysctl: sysctlnametomib("kern.maxposixlocksperuid"): Operation not permitted
rc=1
+ echo 'rc=1'
+ sysctl kern.hostid kern.domainname kern.maxposixlocksperuid
kern.hostid: 0
kern.domainname: 
kern.maxposixlocksperuid: 32528
=== [F3] jailed hostname READ still works (prison-scoped) ===
+ echo '=== [F3] jailed hostname READ still works (prison-scoped) ==='
+ jail / df2950fc 127.0.0.4 /bin/sh -c hostname
df2950fc
=== [F4] HOST root can still write (not over-restricted) ===
+ echo '=== [F4] HOST root can still write (not over-restricted) ==='
+ sysctl -w 'kern.hostid=99'
kern.hostid: 0 -> 99
+ sysctl kern.hostid
kern.hostid: 99
+ date
Fri Sep  4 00:25:04 UTC 2026
FIXTEST-DONE
+ echo FIXTEST-DONE