DF-2716 — nlookup() trailing-slash drops NLC_STICKY / NLC_APPENDONLY dflags

(sticky-bit and append-only directory deletion restriction bypass)

What

sys/kern/vfs_nlookup.c nlookup() decides whether to collect directory feedback flags (NLC_STICKY, NLC_APPENDONLY, NLC_IMMUTABLE) into the local dflags using

if (*nptr == '/' || (saveflag & NLC_MODIFYING_MASK) == 0) {   /* :654 */
        naccess(..., NULL, 0);         /* no dflags */
} else {
        naccess(..., &dflags, 0);      /* collect dflags */
}

nptr points just past the current path component. For a path whose LAST component is followed by a trailing slash — rmdir("/tmp/victim/") — *nptr == '/' is true even though islastelement(nptr) says this is the final component. The leaf's parent directory is therefore misclassified as an intermediate directory and its feedback flags are never collected. The final leaf naccess() (:1213, nd->nl_flags | dflags) then runs with dflags == 0, so naccess_lva() never sees NLC_STICKY (:1902) or NLC_APPENDONLY (:1838) and the corresponding restrictions are skipped.

No filesystem re-checks the sticky bit for rmdir/rename on hammer2 (the project's root filesystem), and tmpfs only re-checks APPEND/IMMUTABLE — not sticky. UFS's own old-API rmdir check is #if 0'd ("handled by kernel now", ufs_vnops.c:1483).

Reproduce (on the guest, as root)

cc -O0 -g -o /tmp/df2716_bin/df2716 df2716.c
sh run.sh /df2716h        # hammer2 root fs  (or: sh run.sh /tmp — tmpfs)

Expected (vulnerable stock kernel)

a1 control rmdir  /BASE/victim      => EACCES   (sticky enforced)
a2 PoC     rmdir  /BASE/victim/     => 0  *** sticky BYPASSED ***
a3 control rename /BASE/victim ...  => EACCES
a4 PoC     rename /BASE/victim/ ... => 0  *** sticky BYPASSED ***
a5 PoC     rename own -> victim/    => ENOENT (gate bypassed — no
                                         EACCES; FS-internal failure)
b1 control rmdir  sappnd-dir/sub    => EPERM
b2 PoC     rmdir  sappnd-dir/sub/   => 0  *** append-only BYPASSED ***
                                         (hammer2; tmpfs re-checks
                                         APPEND itself)

With fix.diff applied (islastelement-based condition) the same run yields EACCES/EPERM for a2, a4 and b2; controls unchanged; regression suite (non-sticky dir-over-dir rename, plain creates/renames) still passes.

Files

• df2716.c — phase-driven syscall PoC (a1..a5, b1, b2)
• run.sh — root fixture driver + matrix (arg: base dir)
• fix.diff — one-line semantic fix + comment
• build.log, run.log (tmpfs), run.hammer2.log, run.baseline.log (fresh-boot hammer2), run.fixed.log (patched kernel) — full outputs
• verdict.json / manifest.json / VERDICT.md

DF-2716 VERDICT

Status: reproduced (uid-gated access-control bypass; not memory corruption) Impact: sticky-bit / append-only-directory deletion restriction bypass (unprivileged user deletes/renames other users' entries in +t directories and deletes entries in sappnd directories) — kernel-verified, fix-verified.

Root cause (path:line, this tree)

• sys/kern/vfs_nlookup.c:653-660 — dflags collection condition *nptr == '/' || (saveflag & NLC_MODIFYING_MASK) == 0. For a leaf component followed by a trailing /, nptr points at that /, so the second branch (which passes &dflags to naccess()) is never taken even though islastelement(nptr) (computed at :678) correctly reports the component as last.
• sys/kern/vfs_nlookup.c:1704-1711 — naccess() feeds NLC_STICKY (sticky bit set on the dir and dir owner != cred) and NLC_APPENDONLY (dir flagged APPEND) back through *nflagsp (= &dflags) only.
• sys/kern/vfs_nlookup.c:1213-1215 — final leaf check runs naccess(..., nd->nl_flags | dflags, ...); with dflags == 0 the flags from the leaf's parent are missing.
• sys/kern/vfs_nlookup.c:1902-1905 — naccess_lva() returns EACCES for NLC_DELETE | NLC_RENAME_SRC | NLC_RENAME_DST when NLC_STICKY is set (non-owner in sticky dir). Never triggers without the flag.
• sys/kern/vfs_nlookup.c:1838-1842 — same for NLC_APPENDONLY (governing dir append-only implies NOUNLINK for its entries).

Downstream, nothing re-checks sticky on the paths that matter: hammer2 has no VSVTX/sticky logic at all (rg VSVTX|S_ISTXT sys/vfs/hammer2/ → nothing), tmpfs re-checks APPEND|IMMUTABLE|NOUNLINK (tmpfs_vnops.c:1132) but not sticky, and UFS's rmdir flag check is #if 0'd with the comment "handled by kernel now" (ufs_vnops.c:1483).

How it was reproduced

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (stock INVARIANTS kernel), root fs hammer2, /tmp tmpfs. Unprivileged user maxx (uid 1001, not in wheel).

Root driver run.sh creates, per phase, a fresh fixture: a 1777 root-owned sticky directory containing a root-owned empty victim dir, and (for b*) a 1777 root-owned sappnd directory containing sub. The PoC binary then performs exactly one syscall as maxx per phase.

Fresh-boot baseline (run.baseline.log, kernel #0 after vm.sh reset with-src; identical to the first run run.hammer2.log before the reset):

The same a1..a4 matrix on tmpfs (run.log) reproduces identically (a2/a4 succeed), proving it is the generic VFS gate, not an FS quirk.

Control experiment: on a non-sticky 777 dir, dir-over-dir rename with trailing slash succeeds normally (slash OK), i.e. the trailing slash is not independently rejected anywhere — the only difference in the sticky fixture is the missing NLC_STICKY.

Exploit chain (what an attacker gains)

Unprivileged local user, default config (/tmp is 1777):

1. Delete any other user's empty directories in sticky directories (rmdir("/tmp/victim/")) — denied without the slash.
2. Move any other user's directories out of a sticky directory (rename("/tmp/victim/", "/home/attacker/stolen")) — the directory (and everything below it) is relocated into attacker-controlled namespace; availability loss for the victim and subsequent rename-over/delete games on the moved tree's parent (contents stay protected by their own modes).
3. Defeat administrator append-only (chflags sappnd) directories on hammer2: entries can be deleted with a trailing slash — the flag is documented as implying NOUNLINK for entries.

No memory corruption is involved; this is a pure kernel authorization bypass (CWE-863), so there is no uid=0 chain — the primitives above are the end state.

Fix validation

fix.diff (authored after reproduction; applied only inside the guest's /usr/src, never on the audit tree) replaces the misclassification test with islastelement(nptr) == 0:

-   if (*nptr == '/' || (saveflag & NLC_MODIFYING_MASK) == 0) {
+   if (islastelement(nptr) == 0 || (saveflag & NLC_MODIFYING_MASK) == 0) {

islastelement() skips trailing slashes (:456-461), so the leaf's parent is now always the component that collects dflags. Semantics are otherwise identical: non-modifying lookups still take the NULL branch, and true intermediate components still skip collection.

Built with make nativekernel KERNCONF=X86_64_GENERIC in-guest, installed, rebooted, and the exact same matrix re-run:

• a2 → EACCES, a4 → EACCES, b2 → EPERM (bypasses gone)
• a1/a3/b1 controls unchanged (still denied, same errnos)
• regression: non-sticky dir-over-dir rename with and without trailing slash still succeeds; plain rmdir/rename of the user's own dirs in 1777 dirs still succeeds (see run.fixed.log tail).

Notes / limits

• unlink("victim/") on a regular file is stopped earlier by the ENOTDIR check at :1127-1131 (leaf ncp is not NCF_ISDIR) — file deletion via this bug is not reachable, only directory rmdir/rename.
• a5 (rename-over) bypassed the gate but did not complete for unrelated kern_rename/FS reasons; not counted as a weaponized vector.
• Reproduced across two independent boots of the stock kernel (before and after vm.sh reset with-src) — deterministic, not a race.