DF-2769 — stale unix98 pty master re-open = session takeover (root command injection)

What it is

When the legitimate master of a unix98 pty closes while the slave side is still open (crashed xterm, dead tmux/screen server, killed script, nohup'd session leader), ptcclose() (sys/kern/tty_pty.c:637-689)

• clears t_oproc (:674) — disarming ptcopen's only "already has a master" gate (tty_pty.c:587),
• NULLs pt_prison (:676) — disarming ptcopen's jail isolation gate (tty_pty.c:580),
• sets both device nodes to uid 0 gid 0 mode 0666 (:677-682) — world openable,

while the pty is not terminated (termination requires !PF_SOPEN, tty_pty.c:273), so the master cdev /dev/ptm/N stays registered. ptcopen() then admits any local user as the new master of the still-live slave session. The TS_ZOMBIE fence set by ttymodem(0) (tty.c:1616-1630) is cleared by the new master itself: ptyioctl's master switch intercepts TIOCSETA* only to flush the outq and falls through to ttioctl, whose TIOCSETA/SETAW/SETAF handler clears TS_ZOMBIE when CLOCAL gets set (sys/kern/tty.c:1065-1072, 1077).

The new master then has, against the surviving session:

• input injection — ptcwrite() → l_rint → the victim's tty reads (the victim's shell executes it),
• output capture — ptcread() drains t_outq,
• signal injection — TIOCSIG → pgsignal(t_pgrp, sig, 1) with any signal < NSIG,
• device re-chown: the pty is re-owned to the attacker (tty_pty.c:616-621).

Unix98 semantics elsewhere (Linux, FreeBSD pts): after the master closes the pty is dead for everyone (slave gets EIO/SIGHUP, no new master can ever attach). DFly's master-cdev persistence + permissive ptcopen is the deviation.

Precondition (why this is not the default config)

/dev/ptm/* nodes are created DEVFS_HIDDEN (sys/vfs/devfs/devfs_core.c:2125-2133) and devfs_spec_open refuses hidden nodes (ENOENT). Exposure requires a devfs show rule covering ptm and its children — exactly what jail devfs rulesets / "expose /dev" recipes produce, applied any time after the node exists (the hide is re-applied at each ptm-node creation, devfs_core.c:2130, so rules applied at creation time lose; rules applied later — e.g. an admin devfsctl -a pass or a jail mount with a show-all ruleset — win). The PoC uses devfsctl as root to load show ptm + show ptm/*, modeling such a configuration; the kernel-side chain needs no privilege.

Reproduce

cc -O2 -Wall -o pty_master_hijack pty_master_hijack.c

# default config control (fenced):
./pty_master_hijack victim &           # prints UNIT=/dev/pts/N, closes master
./pty_master_hijack attack /dev/pts/N /tmp/cmd
# -> open /dev/ptm/N: No such file or directory(2), RESULT=FENCED

# with devfs rule exposing ptm (run.sh):
devfsctl -a -m /dev -f rules      # show ptm ; show ptm/*
./pty_master_hijack attack /dev/pts/N /tmp/cmd    # as ANY other user
# -> master opened, TS_ZOMBIE cleared via TIOCSETAW+CLOCAL,
#    command injected into the victim's tty; victim output readable

# decisive run: victim = ROOT-owned session, attacker = nobody,
# cmd = "id > /tmp/df2769_root_pwn"
# -> /tmp/df2769_root_pwn owned by root, content "uid=0(root) ..."

Fix

Refuse master re-open while the slave is still open (PF_SOPEN → EIO in ptcopen). PF_SOPEN can only be set after a previous master existed, so first-open behavior is unchanged. See fix.diff.

DF-2769 VERDICT

Status: reproduced — unprivileged (nobody) arbitrary command execution in a surviving ROOT pty session (uid=0 file created by the victim session), conditional on a devfs rule exposing /dev/ptm (fenced with ENOENT on the default ruleset).

Chain (all steps live-verified on stock INVARIANTS kernel #0)

1. Victim (root): posix_openpt → grantpt/unlockpt → ptsname → UNIT=/dev/pts/1; child: setsid + TIOCSCTTY, dup2 slave to stdio, signal(SIGHUP, SIG_IGN) (nohup semantics), loop reading tty lines and system()-ing them; parent closes the master fd at t+1s and exits → models a crashed xterm/tmux-server with the session alive. After ptcclose: t_oproc=NULL (tty_pty.c:674), pt_prison=NULL (:676), devs/devc → 0:0 mode 0666 (:677-682); termination blocked by PF_SOPEN (:273); ttymodem(0) set TS_ZOMBIE + SIGHUP (ignored).
2. Control (default devfs): attacker open("/dev/ptm/1") → ENOENT (DEVFS_HIDDEN, devfs_core.c:2125-2133 + devfs_spec_open accessibility check) — captured in run.log as RESULT=FENCED.
3. Precondition (root, once): devfsctl -a -m /dev -f rules with show ptm + show ptm/* — /dev/ptm/1 becomes visible crw-rw-rw- root:wheel. This models jail/"expose /dev" rulesets; note the kernel re-hides at each new ptm node creation, so exposure occurs whenever rules are (re)applied after creation — e.g. any later devfsctl pass or a jail devfs mount with a showing ruleset.
4. Attacker (nobody): open("/dev/ptm/1", O_RDWR) → succeeds (ptcopen gates all disarmed). TIOCGETA + TIOCSETAW with c_cflag |= CLOCAL → ttioctl tty.c:1065-1072 clears TS_ZOMBIE (log: "TS_ZOMBIE cleared via TIOCSETAW+CLOCAL").
5. write(master, "id > /tmp/df2769_root_pwn\n") → ptcwrite → l_rint → victim's fgets executes system("id > /tmp/df2769_root_pwn") as root; attacker read() the echoed line and "[victim rc=0]".
6. Result: /tmp/df2769_root_pwn owned by root, content uid=0(root) gid=0(wheel) ....

Impact

With /dev/ptm exposed (jail rulesets, devfs.conf show rules), any local user hijacks any still-open pty session whose master died: command injection as the session owner (root sessions → uid 0), terminal output capture (secrets/passwords typed in the session), arbitrary-signal injection (TIOCSIG), and device re-chown lockout. On the default devfs ruleset the by-name path is ENOENT-fenced; the kernel-side defect is unchanged.

Not-a-bug notes

• Same-uid re-mastering is equally possible (weaker demo).
• The reclaim of fully-closed-but-session-referenced ptys (t_refs>0 zombie units, DF-2687 state) is a related but distinct window; the PF_SOPEN fence in fix.diff deliberately leaves it untouched.

Fix validation

Combined patch (DF-2768+DF-2769 hunks) built (make -j6 nativekernel && make installkernel) and booted in the guest; re-running the attack (with the devfs rule re-applied) the stale master open then fails with EIO (fence hit) and no injection occurs; victim session stays ZOMBIE. See fix run logs.

Film take (Oct 16 2026 — stock kernel, verify/maintenance run)

Continuous two-actor disclosure demo on the stock clean-install kernel (DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT #1), one untrimmed session 11:40:40–11:40:57 UTC:

• run_film.log — the authoritative untrimmed transcript (9 beats): root session shown ALIVE and INTERACTIVE (whoami→root), terminal crash, ps proof the uid-0 session leader survives, nobody probe FENCED (ENOENT, default devfs), admin show ptm rules applied (after a churn/login modeled by film_churn), stale master visible crw-rw-rw- root root, then the takeover: master opened, TS_ZOMBIE cleared via TIOCSETAW+CLOCAL, payload id > /tmp/df2769_pwned; cat /etc/master.passwd > /tmp/df2769_secret injected, whoami; hostname round-trip shows root/dfbsd answering on the attacker's screen, 0:0-owned marker written, RESULT=HIJACKED; proofs: all three files root:wheel-owned, uid=0(root) content, master.passwd hash exfil'd. Attacker re-checked as nobody after the takeover.
• serial_console_film.log — the kernel's own serial console recorded the decisive arc (BEAT 5 takeover through FILM END), including the root shell's answers to nobody. (Console drops lines under burst; earlier beats live only in run_film.log.)
• FILM_SCRIPT.md — beat-by-beat re-recording guide + the two operational gotchas discovered while hardening the take: (a) a failed open("/dev/ptm/N") leaves a negative namecache entry that devfsctl -a does NOT invalidate (rule apply never bumps mnt_namecache_gen; only devfs node creation does — sys/vfs/devfs/devfs_core.c:277), so the demo churns once (any pty allocation, i.e. any login) between the fenced probe and the rule application; (b) devfsctl -r (node reset) must never be used — it breaks later show-rule application for the rest of the boot. Neither is a new kernel finding; both are demo-environment behavior of the existing namecache/devfs machinery.
• Fix-contrast was skipped for this take: the stock snapshot ships no /usr/src, so the patched kernel needs a full source+kernel rebuild (out of scope per mission). The Sep 1 fix validation stands unchanged: patched kernel refuses the stale master open with EIO, no injection, no proof file.

New artifacts: film_victim.c, film_attack.c, film_churn.c, film_run.sh, run_film.log, serial_console_film.log, FILM_SCRIPT.md. The original verified rig (pty_master_hijack.c / run.log) is untouched.

Kernel references

• sys/kern/tty_pty.c:636-689 (ptcclose disarms all gates, 0666)
• sys/kern/tty_pty.c:560-634 (ptcopen admission: 571-573 si_drv1, 580-584 prison, 585-592 t_oproc — none fence the stale case)
• sys/kern/tty_pty.c:273-293 (termination gated on !PF_SOPEN)
• sys/kern/tty_pty.c:745-750 + 1049-1055 (TS_CONNECTED/EOF paths)
• sys/kern/tty_pty.c:1081-1275 (ptyioctl master fallthrough to ttioctl)
• sys/kern/tty.c:1060-1080 (TIOCSETA* CLOCAL clears TS_ZOMBIE)
• sys/kern/tty.c:1600-1650 (ttymodem ZOMBIE/SIGHUP on carrier loss)
• sys/vfs/devfs/devfs_core.c:2068-2133 (node creation + ptm hide)
• sys/vfs/devfs/devfs_core.c:2598-2603 + devfs_vnops.c:867-869 (DEVFS_HIDDEN → ENOENT fence)
• sys/vfs/devfs/devfs_rules.c:325-331 (show rule clears DEVFS_HIDDEN)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

DF-2769 — FILM SCRIPT (disclosure-video demo run)

One continuous take, two actors, stock kernel. Deliverables: run_film.log (untrimmed driver transcript, the authoritative record), serial_console_film.log (what the kernel's own serial console recorded of the decisive arc), film_run.sh (the take driver), film_victim.c / film_attack.c / film_churn.c (the actors).

• Stock kernel: DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT #1 (clean-install snapshot, no custom build, INVARIANTS off).
• Root appears ONLY as the victim. The attacker is nobody (uid 65534) the whole way through; id is re-checked after the takeover.
• Wall time of the take: 11:40:40 → 11:40:57 UTC (see timestamps in run_film.log).

Cast / terminals (for a human re-recording)

The automated take drives all three from one script (film_run.sh), teeing everything into run_film.log and /dev/console (serial line). For a two-terminal re-recording, run the beats below manually in the same order — every command is in the log.

Beat sheet (timestamps from run_film.log)

BEAT 0 — SETUP [11:40:40] — stage: kernel line, narrator uid=0, attacker will be nobody (uid shown up front so nobody can accuse a swap), proof files pre-checked absent, the two actors compiled on camera.

BEAT 1 — VICTIM LIVE [11:40:40–:45] — a root admin session opens on /dev/pts/0 (pid 867) inside its terminal. On the VICTIM screen the shell is alive and interactive: whoami → root, hostname → dfbsd, id → uid=0(root)…, echo ROOT-SESSION-ALIVE. This is the session we will own.

BEAT 2 — TERMINAL CRASH [11:40:45] — *** TERMINAL CRASH *** (xterm killed / ssh connection dropped): the master closes. Kernel fact box on screen: ptcclose() disarms every ptcopen() gate, leaves /dev/ptm/N registered 0666 root:root, tty goes ZOMBIE, SIGHUP is ignored by the nohup-style session leader. ps proof: pid 867, UID 0, still running; slave device /dev/pts/0 still present. A root shell now waits silently on a dead pty whose master seat is empty.

BEAT 3 — ATTACKER PROBE, DEFAULT DEVFS [11:40:45] — ATTACKER window: su -m nobody -c "/tmp/film/film_attack /dev/pts/0" → open("/dev/ptm/0") -> No such file or directory, RESULT=FENCED. Honesty beat: on a stock devfs ruleset /dev/ptm is DEVFS_HIDDEN; ls /dev/ptm* shows only /dev/ptmx. The bug needs a config precondition (next beat).

BEAT 4 — CONFIG PRECONDITION [11:40:45] — the system churns (any login allocates a pty — film_churn), then the host's admin rules are (re)applied: show ptm + show ptm/* via devfsctl -a — exactly the rule class jail devfs rulesets and expose-/dev recipes install. ATTACKER view flips: ls -l /dev/ptm* now shows /dev/ptm/0 crw-rw-rw- root root — the dead terminal's seat, world-openable.

BEAT 5 — TAKEOVER, INJECTION, LIVE CONTROL [11:40:47–:57] — same unprivileged command as BEAT 3, different world now: 1. open("/dev/ptm/0", O_RDWR) → master fd opened — nobody is the new master of a live root session; 2. TIOCSETAW(c_cflag |= CLOCAL) → TS_ZOMBIE cleared (the kernel's last fence, cleared by the attacker itself, sys/kern/tty.c:1065-1077); 3. INJECT id > /tmp/df2769_pwned; cat /etc/master.passwd > /tmp/df2769_secret — the ATTACKER screen shows the root prompt accepting the payload; 4. INJECT whoami; hostname — the ATTACKER screen shows the root shell answering root / dfbsd live (the money shot); 5. INJECT echo DF-2769-PWNED > /tmp/df2769_marker — a 0:0-owned marker; RESULT=HIJACKED.

BEAT 8 — PROOF [11:40:57] — attacker still nobody; the three files created by the root session for the attacker: all root:wheel-owned; /tmp/df2769_pwned contains uid=0(root); /tmp/df2769_secret is /etc/master.passwd (root's password hash on screen, truncated); marker owner=root:wheel.

BEAT 9 — CLEANUP [11:40:57] — victim session terminated, proof files removed, devfs rules cleared. FILM END.

Re-recording gotchas (learned the hard way — keep this order)

1. Never run devfsctl -r (node reset) on a live system in this demo: it breaks later show rule application for the boot. Clear rules with devfsctl -c only; nodes re-hide at next boot.
2. A failed open("/dev/ptm/N") caches a negative namecache entry that survives the subsequent devfsctl -a (rule apply doesn't bump devfs's mnt_namecache_gen; only node creation does, sys/vfs/devfs/devfs_core.c:277). Between the fenced probe (BEAT 3) and the rule application (BEAT 4) you must let the system churn once — any pty allocation/free (film_churn, i.e. what any login does) — otherwise ls/open of /dev/ptm keep returning ENOENT for up to the life of that entry. This is why the driver runs film_churn before devfsctl -a.
3. Churn after the rules would re-hide /dev/ptm (creation-time ptm magic, devfs_core.c:2125-2133) — always churn then apply rules.
4. The victim session leader must ignore SIGHUP (nohup semantics) and tolerate tty EOF to survive the terminal death — that is the surviving-session class this finding is about (crashed xterm / dropped ssh with a nohup'd leader).
5. Serial console (/dev/console) drops lines under burst; it caught the whole decisive arc (BEAT 5→END) in serial_console_film.log, but the authoritative untrimmed transcript is run_film.log.

Fix-contrast (not in this take)

The stock clean-install snapshot ships no /usr/src; producing the patched kernel means a full source + kernel build, which the mission says to skip. Prior fix validation stands unchanged: on the fix.diff kernel (VERDICT.md "Fix validation"), with identical setup and devfs exposure, the stale master open fails with EIO (PF_SOPEN fence), no injection, no proof file.