DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2487

Modifying ioctls (MPTIO_WRITE_CFG_PAGE MPTIO_RAID_ACTION) allowed via read-only file descriptor

Summary

mpt character device created mode 0640 (operator group read-only) but mpt_ioctl performs no FWRITE check before dispatching state-changing ioctls MPTIO_WRITE_CFG_PAGE and MPTIO_RAID_ACTION. Operator-group user who can only open node O_RDONLY can rewrite controller config pages and issue RAID actions including volume deletion bypassing write-permission boundary implied by 0640 mode. DragonFly imposes no framework-level requirement fd opened FWRITE to issue ioctl so driver is sole enforcer.

Discussion (0)

No comments yet.