DF-3024 — tmpfs utimes timestamp forgery by non-owner (VFS-contract divergence)

• unprivileged local user (write access, not owner)
• default-mounted tmpfs (/tmp, /var/run/shm)
• utimensat() with explicit old timestamps on a root-owned 0666 file → returns 0, timestamps forged (POSIX: EPERM; UFS enforces EPERM)

Build & run

# guest, as root:
touch /tmp/df3024_victim && chmod 666 /tmp/df3024_victim

# guest, as unprivileged user:
cc -O2 -o df3024 trigger.c && ./df3024

Expected output (see run.log):

before : uid=0 mode=0666 mtime=1788606959
utimensat = 0
after  : mtime=1000000000 atime=1000000000 uid=0
SUCCESS-CRITERION: forged mtime==1000000000 by non-owner -> FORGERY REPRODUCED

Fix proposal: fix.diff (mirrors ufs_vnops.c:461-470 ownership + VA_UTIMES_NULL gating in tmpfs_chtimes). Not kernel-validated (Low severity; fix validation was spent on DF-3023).

DF-3024 — tmpfs_chtimes applies utimes with no ownership check (VFS-contract divergence)

What

tmpfs_chtimes() (sys/vfs/tmpfs/tmpfs_subr.c:1291-1325) applies va_atime/va_mtime to the node after only three checks: read-only mount, IMMUTABLE/APPEND flags, and lock state. It performs no ownership or privilege check and ignores va_vaflags & VA_UTIMES_NULL.

Every other local filesystem enforces the POSIX rule at exactly this point — e.g. UFS (sys/vfs/ufs/ufs_vnops.c:461-470):

if (cred->cr_uid != ip->i_uid &&
    (error = caps_priv_check(cred, SYSCAP_NOVFS_SETATTR)) &&
    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
    (error = VOP_EACCESS(vp, VWRITE, cred))))
        return (error);

(same pattern in ext2fs:349, msdosfs:405, hpfs:535, smbfs:359).

Why the VFS layer does not save tmpfs

kern_utimensat (sys/kern/vfs_syscalls.c:3961) gates with NLC_OWN | NLC_WRITE, and naccess_lva() (sys/kern/vfs_nlookup.c:1869-1925) admits root, the owner, OR anyone with write permission (group/world S_IWUSR-shifted mode check at :1910-1924). The stricter POSIX rule — forging explicit (non-current) timestamps is owner-only; a mere writer may only set the current time (VA_UTIMES_NULL) — is deliberately deferred to the filesystem's chtimes. tmpfs never does it.

kern_futimens (:3847) uses the same NLC_OWN | NLC_WRITE gate, so an fd opened for write (or opened read-only? no — naccess requires write mode bits) on a non-owned file also reaches VOP_SETATTR unguarded.

The NFS path (nfs_setattr → VOP_SETATTR) performs no NLC checks at all; tmpfs supports export (tmpfs_mountctl, MOUNTCTL_SET_EXPORT, tmpfs_vnops.c:1889-1896), so a remote SETATTR can forge timestamps on any file in an exported tmpfs regardless of mode bits — the exact shape of DF-3001 (hammer1).

Reproduced

Guest DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC, default tmpfs /tmp.

1. root: touch /tmp/df3024_victim && chmod 666 /tmp/df3024_victim (file owned root:wheel, mode 0666, mtime = now).
2. unprivileged user maxx (uid 1001, not the owner, write access only) runs ./df3024 → utimensat(AT_FDCWD, "/tmp/df3024_victim", {mtime=atime=1000000000}, 0).
3. Result: returns 0; mtime and atime become 1000000000 (2001-09-09) on the root-owned file. POSIX requires EPERM here (non-owner, explicit non-NULL timestamps); UFS returns EPERM for the identical operation via its :464 check.

before : uid=0 mode=0666 mtime=1788606959
utimensat = 0
after  : mtime=1000000000 atime=1000000000 uid=0
SUCCESS-CRITERION: forged mtime==1000000000 by non-owner -> FORGERY REPRODUCED

Impact

Integrity of timestamp-based logic on the world's most exposed directories — /tmp, /var/run, /dev/shm-style mounts: defeat tamper-evidence/incident-response ordering, make/rsync/tar freshness decisions, tmpwatch-style cleanup. No memory-safety impact. Low severity (matches DF-3001), but note it is reachable locally on default mounts (DF-3001's hammer1 case needed an NFS export).

Fix

Mirror the UFS check in tmpfs_chtimes (sys/vfs/tmpfs/tmpfs_subr.c), using the node's uid and the caller's cred:

    if (vap... /* in chtimes signature: vaflags */)
    ...
    if (cred->cr_uid != node->tn_uid &&
        (error = caps_priv_check(cred, SYSCAP_NOVFS_SETATTR)) != 0 &&
        ((vaflags & VA_UTIMES_NULL) == 0 ||
        (error = tmpfs_access_write(vp, cred)) != 0))
        return (error);

(concretely: add VA_UTIMES_NULL gating with priv_check/caps_priv_check and a VOP_EACCESS-style write test — see fix.diff.)