DF-2743 — DIOCGKERNELDUMP has no privilege check on the ioctl path

Impact

sys/kern/subr_disk.c:1186-1189 forwards DIOCGKERNELDUMP straight to disk_dumpconf() -> set_dumper() (sys/kern/kern_shutdown.c:949-961). Neither has a priv_check / caps_priv_check / FWRITE gate. Compare FreeBSD, which requires PRIV_VFS_KERNELDUMP in its DIOCGKERNELDUMP handler.

Practical reachability today: opening any cooked disk node goes through diskopen() which requires SYSCAP_RESTRICTEDROOT (subr_disk.c:1072), so the ioctl is presently reachable only by root-class credentials (verified: an operator-group user gets EPERM at open, before the ioctl). The missing check is therefore defense-in-depth / hardening, plus a correctness gap if the open gate is ever relaxed or devices exposed via devfs rulesets.

Reproduce (guest)

cc -O -o poc2743 poc2743.c
./poc2743 /dev/vn0            # as root: disable->OK enable->OK enable2->EBUSY
su -m op1 -c "/home/op1/poc2743 /dev/vn0"   # op1 in group operator:
                                           # open: Operation not permitted
                                           # (diskopen SYSCAP_RESTRICTEDROOT gate)

Observed

root: disable -> 0; enable -> 0 (dumper registered on vn0); enable again -> EBUSY (set_dumper's dumper!=NULL path) — the whole register/clear machinery is driven with no privilege query anywhere past the open gate.

DF-2743 VERDICT — DIOCGKERNELDUMP without privilege check

Status: not_reproduced (as an unprivileged action). Impact: none on default config. Confidence: certain (about the missing check, by inspection + live exercise of the ungated path as root).

• The ioctl path is provably check-free: diskioctl() intercepts DIOCGKERNELDUMP (sys/kern/subr_disk.c:1186-1189) and calls disk_dumpconf() (subr_disk.c:914-939) → set_dumper() (sys/kern/kern_shutdown.c:949-961); none of the three contains a priv_check/caps_priv_check/FWRITE gate (contrast FreeBSD geom_disk, which enforces PRIV_VFS_KERNELDUMP).
• Live: as root the full register/clear machinery was driven through the ioctl alone — disable→0, enable→0, enable again→EBUSY (run.log).
• However an operator-group user (gid 5) cannot even open a cooked disk node: diskopen() requires SYSCAP_RESTRICTEDROOT (sys/kern/subr_disk.c:1070-1073); op1 got EPERM at open. On a default system the missing check is therefore unreachable below root-class credentials → filed as hardening (Info), still worth fixing upstream (defense in depth; devfs rulesets / future gate changes).

Suggested fix

In diskioctl()'s DIOCGKERNELDUMP branch, require both FWRITE on the fd and a privilege check, e.g. if (!(ap->a_fflag & FWRITE)) return (EBADF); error = priv_check(curthread, PRIV_VFS_KERNELDUMP); (or a suitable caps_priv_check) before calling disk_dumpconf().