DF-2793 — rtprio()/lwp_rtprio() lack PRISON_CHECK: cross-jail read of

host scheduling parameters

What

sys_rtprio() (kern_resource.c:690-759) and sys_lwp_rtprio() (:558-670) perform no prison check on any path, unlike every other priority syscall in this file (getpriority :104/:123, setpriority :208/:233/:277, ioprio_get :347/:366, ioprio_set :450/:475/:520), all of which gate on PRISON_CHECK(curtd->td_ucred, p->p_ucred) (sys/sys/proc.h:462 — same-prison-only).

Consequences:

• RTP_LOOKUP has no credential check at all before the copyout, so any jailed user whose uid matches a host user can read that host process's realtime scheduling parameters.
• The uid-ownership gate (:613-618, :711-716) short-circuits on cr_uid == 0, so jailed root can RTP_LOOKUP any process on the host — revealing which host processes run realtime/idle classes and their exact priorities.

(RTP_SET stays contained for unprivileged cross-jail callers: the caps_priv_check(SYSCAP_NOSCHED) branch denies setting other pids :620-625/:718-723, and jailed root lacks NOSCHED.)

Build / Run (root — it jails a child to demonstrate the boundary)

cc -O2 -o jail_rtprio jail_rtprio.c
./jail_rtprio

The parent (host root) sets its own rtprio to {RTP_PRIO_NORMAL, 7} and forks; the child jails itself via jail(2) (DF jail(2) auto-attaches, kern_jail.c:227) and probes the parent's pid from inside the jail.

Expected output

[jailed root] parent (host, pid 27363) rtprio probe:
  rtprio(RTP_LOOKUP, 27363)      = OK  type=1 prio=7   <== LEAK
  getpriority(PROCESS, 27363)    = No such process (prison-checked)
  setpriority(PROCESS, 27363, 10) = No such process (prison-checked)
  rtprio(RTP_LOOKUP, 1/init)  = OK  type=1 prio=0   <== LEAK

rtprio returns the host process's exact prio 7 across the jail boundary while getpriority on the same pid correctly returns ESRCH.

Fix

fix.diff — add PRISON_CHECK to both syscalls (ESRCH on mismatch), matching the rest of the file. Authored post-verification; kernel rebuild not performed for this Low finding (fix_status: not_testable).

DF-2793 VERDICT

Finding: sys_rtprio() and sys_lwp_rtprio() omit PRISON_CHECK entirely (sys/kern/kern_resource.c:582-601 / 701-704), breaking the jail confinement that every other priority syscall in the same file enforces.

Status: REPRODUCED. Severity Low (cross-jail information leak).

Root cause

• PRISON_CHECK(cr1, cr2) (sys/sys/proc.h:462) is DragonFly's jail visibility test: (!(cr1)->cr_prison || (cr1)->cr_prison == (cr2)->cr_prison) — a jailed cred must only see same-prison procs.
• getpriority (:104, :123), setpriority (:208, :233, :277), ioprio_get (:347, :366), ioprio_set (:450, :475, :520) all apply it around every p->p_ucred dereference of a target proc. sys_rtprio and sys_lwp_rtprio apply it nowhere.
• sys_rtprio's RTP_LOOKUP additionally has no uid-ownership check before the copyout, and the RTP_SET ownership gate (:711-716) treats cr_uid == 0 as privileged, which jailed root satisfies. Result: jailed root can enumerate/read rtprio of arbitrary host processes; a jailed user can read host processes whose euid matches their uid.
• Write-side containment (verified by inspection): for non-NOSCHED callers the if (uap->pid) EPERM at :720-723 (and :622-625) blocks cross-pid RTP_SET; jailed root lacks SYSCAP_NOSCHED (kern_jail.c:857- 869 denies group-5 caps in jails). So the reachable defect is read-only: scheduling class + priority of foreign-jail processes.

Run

Guest dfbsd 6.5-DEVELOPMENT X86_64_GENERIC, as root:

• Child jails itself (jail(2), which in DF creates AND attaches — kern_jail.c:227) with path /tmp/jail2793.
• From inside the jail (still uid 0, cred->cr_prison = new sub-jail):
• rtprio(RTP_LOOKUP, parent_pid) → OK, type=1 prio=7 — the exact value the host parent had set for itself → real data crossed the boundary.
• getpriority(PRIO_PROCESS, parent_pid) → ESRH (prison check present) — same file, same target, different syscall.
• setpriority(...) → ESRCH likewise.
• rtprio(RTP_LOOKUP, 1) → OK — init's rtprio readable from jail.
• Reproduced on both kernel #0 and the DF-2791-patched kernel #1.

Impact ceiling

Cross-jail confidentiality leak of scheduling metadata (rtprio class and priority) for all host/foreign-jail processes readable by jailed root, or by any jailed user where uids collide (common: uid 1001 in a jail and on the host). Value is host-process metadata, not kernel memory. Low severity; requires jails to be deployed.

Fix validation

fix.diff adds PRISON_CHECK(curthread->td_ucred, p->p_ucred) → ESRCH to both syscalls. Not rebuilt (Low, read-path only, mirrors five existing call sites in the same file) — fix_status: not_testable.