+ date
Fri Sep  4 00:04:46 UTC 2026
+ uname -r
6.5-DEVELOPMENT
+ sysctl kern.securelevel kern.hostid kern.domainname
kern.securelevel: -1
kern.hostid: 0
kern.domainname: 
+ echo '=== [1] jailed uid-0 raises HOST kern.securelevel ==='
+ jail / df2950ja 127.0.0.4 /bin/sh -c 'id; sysctl -w kern.securelevel=1'
=== [1] jailed uid-0 raises HOST kern.securelevel ===
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
kern.securelevel: -1 -> 1
rc=0
=== [2] HOST root cannot lower it (irreversible) ===
+ echo 'rc=0'
+ echo '=== [2] HOST root cannot lower it (irreversible) ==='
+ sysctl -w 'kern.securelevel=0'
kern.securelevel: 1
sysctl: kern.securelevel=0: Operation not permitted
host-root lower rc=1
=== [3] jailed uid-0 corrupts HOST hostid/domainname ===
+ echo 'host-root lower rc=1'
+ echo '=== [3] jailed uid-0 corrupts HOST hostid/domainname ==='
+ jail / df2950jb 127.0.0.4 /bin/sh -c 'sysctl -w kern.hostid=4242; sysctl -w kern.domainname=pwned-by-jail'
kern.hostid: 0 -> 4242
kern.domainname:  -> pwned-by-jail
+ sysctl kern.hostid kern.domainname
kern.hostid: 4242
kern.domainname: pwned-by-jail
=== [4] jailed NON-root denied ===
+ echo '=== [4] jailed NON-root denied ==='
+ jail / df2950jc 127.0.0.4 /bin/sh -c 'su -m nobody -c "sysctl -w kern.hostid=7"'
kern.hostid: 4242
sysctl: kern.hostid=7: Operation not permitted
rc=1
=== [5] HOST unprivileged user denied (via su maxx) ===
+ echo 'rc=1'
+ echo '=== [5] HOST unprivileged user denied (via su maxx) ==='
+ su -m maxx -c 'id; sysctl -w kern.hostid=7'
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
kern.hostid: 4242
sysctl: kern.hostid=7: Operation not permitted
rc=1
+ echo 'rc=1'
+ sysctl kern.hostid
kern.hostid: 4242
=== [6] jailed uid-0 can also write other host-global tunables ===
+ echo '=== [6] jailed uid-0 can also write other host-global tunables ==='
+ jail / df2950jd 127.0.0.4 /bin/sh -c 'sysctl -w kern.maxposixlocksperuid=1; sysctl -w kern.tls_extra=777'
kern.maxposixlocksperuid: 32528 -> 1
kern.tls_extra: 6144 -> 777
+ sysctl kern.maxposixlocksperuid kern.tls_extra
kern.maxposixlocksperuid: 1
kern.tls_extra: 777
+ date
Fri Sep  4 00:04:46 UTC 2026
DONE-MARKER
+ echo DONE-MARKER