hammer2_vop_setattr applies va_mtime with no owner/VA_UTIMES_NULL privilege check (divergence from the VFS contract UFS enforces)

Summary

hammer2_vop_setattr writes any caller-supplied va_mtime into ip->meta.mtime (:561-566) with no ownership or privilege check. DragonFly's syscall layer lets NON-owners through to VOP_SETATTR whenever they hold write permission (kern_utimensat sets NLC_OWN|NLC_WRITE, vfs_syscalls.c:3961; naccess_lva passes group/world-writable access at vfs_nlookup.c:1910-1925) and relies on the filesystem to enforce the POSIX owner-or-privilege / VA_UTIMES_NULL distinction — UFS does exactly this (ufs_vnops.c:461-470). hammer2 omits it, so any user with mere write permission on a hammer2 file can forge its modification time to arbitrary values, defeating timestamp-based integrity tools (make-style dependency checking, incremental backups, forensic timelines, NFS-exposed timestamp semantics).

Root cause

vnops.c:561-566: if (vap->va_mtime.tv_sec != VNOVAL) { hammer2_inode_modify(ip); ip->meta.mtime = hammer2_timespec_to_time(&vap->va_mtime); ... } — no cr_uid comparison, no caps_priv_check(SYSCAP_NOVFS_SETATTR), no VA_UTIMES_NULL/VWRITE fallback. Contrast ufs_setattr: if (cred->cr_uid != ip->i_uid && (error = caps_priv_check(cred, SYSCAP_NOVFS_SETATTR)) && ((vap->va_vaflags & VA_UTIMES_NULL) == 0 || (error = VOP_EACCESS(vp, VWRITE, cred)))) return (error); (ufs_vnops.c:464-470). The gate must live in the FS because setutimes() passes VA_UTIMES_NULL only when times are UTIME_NOW/NULL (vfs_syscalls.c:3740-3741) while naccess_lva accepts any write-permitted non-owner.

Threat model & preconditions

• Attacker position: unprivileged local user on a hammer2 mount who has write permission (group- or world-writable file) but is NOT the owner.
• Privileges gained or impact: utimensat()/futimens() with arbitrary times succeeds on hammer2 (returns EPERM on an identical UFS file); corrupts metadata relied upon by backup/incremental-sync/forensic tooling. Same gap on the hammer2-backed NFS server path for write-authorized non-owner clients.
• Required config or capabilities: write permission on the file.
• Reachability: utimensat/touch -d.

Proof of concept

Build & run

as user A: chmod 666 /h2/a-owned-file
as user B: struct timespec ts[2]={{1000000000,0},{1000000000,0}};
utimensat(AT_FDCWD, "/h2/a-owned-file", ts, 0);   /* 0 on hammer2 */
stat("/h2/a-owned-file")  /* mtime 2001-09-09 */

Expected output

returns 0 on hammer2 (mtime forged) vs -1/EPERM on the equivalent UFS file.

Impact

Timestamp forgery by non-owners on hammer2; integrity/forensics impact, no memory safety.

Recommended fix

Mirror the UFS gate before applying mtime:

--- a/sys/vfs/hammer2/hammer2_vnops.c
+++ b/sys/vfs/hammer2/hammer2_vnops.c
@@ -561,6 +561,17 @@ hammer2_vop_setattr(struct vop_setattr_args *ap)
 #endif
    if (vap->va_mtime.tv_sec != VNOVAL) {
+       uid_t cur_uid = hammer2_to_unix_xid(&ip->meta.uid);
+
+       if (ap->a_cred->cr_uid != cur_uid &&
+           (error = caps_priv_check(ap->a_cred,
+                         SYSCAP_NOVFS_SETATTR)) &&
+           ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
+           (error = VOP_EACCESS(ap->a_vp, VWRITE, ap->a_cred))))
+       {
+           goto done;
+       }
+       error = 0;
        hammer2_inode_modify(ip);
        ip->meta.mtime = hammer2_timespec_to_time(&vap->va_mtime);

References

• ufs_vnops.c:461-470 (the UFS gate), vfs_syscalls.c:3740-3741, 3961
• POSIX utimensat owner/privilege semantics

Timeline

• 2026-08-28 Discovered during automated audit (pass 2, GLM 5.3).