+ date
Thu Sep  3 23:57:40 UTC 2026
+ uname -a
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
+ sysctl kern.securelevel kern.hostid kern.domainname
kern.securelevel: -1
kern.hostid: 0
kern.domainname: 
=== [1] jailed uid-0 raises HOST kern.securelevel ===
+ echo '=== [1] jailed uid-0 raises HOST kern.securelevel ==='
+ jail / df2950ja 127.0.0.4 /bin/sh -c 'id; sysctl -w kern.securelevel=1'
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
kern.securelevel: -1 -> 1
jail securelevel write rc=0
=== [2] HOST root tries to lower it back ===
+ echo 'jail securelevel write rc=0'
+ echo '=== [2] HOST root tries to lower it back ==='
+ sysctl -w 'kern.securelevel=0'
kern.securelevel: 1
sysctl: kern.securelevel=0: Operation not permitted
host-root lower rc=1
+ echo 'host-root lower rc=1'
+ sysctl kern.securelevel
kern.securelevel: 1
=== [3] jailed uid-0 corrupts HOST kern.hostid / kern.domainname ===
+ echo '=== [3] jailed uid-0 corrupts HOST kern.hostid / kern.domainname ==='
+ jail / df2950jb 127.0.0.4 /bin/sh -c 'sysctl -w kern.hostid=4242; sysctl -w kern.domainname=pwned-by-jail'
kern.hostid: 0 -> 4242
kern.domainname:  -> pwned-by-jail
+ sysctl kern.hostid kern.domainname
kern.hostid: 4242
kern.domainname: pwned-by-jail
=== [4] jailed NON-root is denied (uid gate works) ===
+ echo '=== [4] jailed NON-root is denied (uid gate works) ==='
+ jail / df2950jc 127.0.0.4 /bin/sh -c 'su -m nobody -c "id; sysctl -w kern.hostid=7"'
uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
kern.hostid: 4242
sysctl: kern.hostid=7: Operation not permitted
jailed-nobody rc=1
kern.hostid: 4242
=== [5] host UNPRIVILEGED user is denied ===
+ echo 'jailed-nobody rc=1'
+ sysctl kern.hostid
+ echo '=== [5] host UNPRIVILEGED user is denied ==='
+ sysctl -w 'kern.hostid=7'
kern.hostid: 4242 -> 7
+ echo 'host-unpriv rc=0'
+ echo '=== [6] hostname stays properly jail-scoped (CTLFLAG_PRISON + cap) ==='
+ hostname
host-unpriv rc=0
=== [6] hostname stays properly jail-scoped (CTLFLAG_PRISON + cap) ===
dfbsd
+ jail / df2950jd 127.0.0.4 /bin/sh -c 'hostname; hostname jail-scoped-host; hostname'
df2950jd
hostname: sethostname: Operation not permitted