DF-3197 — devfs rule ioctls reachable from jail: host-wide devfs ruleset manipulation (jail escape)

Where

• sys/vfs/devfs/devfs_rules.c:419 devfs_dev_ioctl() — no priv_check(), no jail check; only gate is the 0600 root:wheel /dev/devfs node (devfs_rules.c:470), which jailed uid 0 passes.
• Rules are stored in the GLOBAL devfs_rule_list (devfs_rules.c:67); DEVFS_RULE_APPLY/DEVFS_RULE_RESET walk the GLOBAL devfs_mnt_list (devfs_core.c:1912-1931) — every devfs mount on the system, including the host's /dev and every other jail's.

What a jailed root can do (all demonstrated on the guest)

1. Open /dev/devfs inside the jail (control node visible ⇒ any jail devfs not explicitly hiding it — this guest ships no /etc/devfs.rules, so a plain jail devfs exposes it; the same holds for custom rulesets that forget to hide devfs).
2. DEVFS_RULE_ADD a SHOW rule → DEVFS_RULE_APPLY "*" → un-hides nodes the HOST hid in the jail's devfs (defeats the jail's devfs ruleset).
3. DEVFS_RULE_ADD a PERM rule with mntpoint "/dev" → DEVFS_RULE_APPLY "/dev" → rewrites permissions on the HOST's /dev (demonstrated: /dev/console 0600 → 0666).
4. Same primitive on any other jail's mounts.

Files

• jail_show.c — PoC (host phase mounts jail devfs + hides mem/zero; jail phase un-hides + opens)
• build.sh, run.sh
• run.log — decisive output (JAIL-ESCAPE: unhidden + OPENED /dev/zero from inside jail, host /dev/console 0666)
• fix.diff — consolidated fix (jailed() gate + the other five findings)
• verdict.json, manifest.json

Build / run

cc -static -O -o jail_show jail_show.c
./jail_show        # as root on the host; expect JAIL-ESCAPE lines

Notes

• /dev/mem was un-hidden and stat-able from the jail; opening it returns EPERM only because memio(4) itself checks jailed() — a driver-level defense devfs does not provide. Any device whose driver lacks that check is fully reachable once shown (demonstrated with /dev/zero).
• The rule engine also never bumps mnt_namecache_gen on SHOW/HIDE (devfs_core.c:277 bumps only on node link); stale namecache entries mask flag changes until the generation is bumped — the PoC links one pid-unique alias to flush it.

DF-3197 — verdict

REPRODUCED on a pristine guest (see README.md and run.log): 1. Host mounted devfs at /jail/dev and hid mem + zero via the rule ioctl (the standard way jail devfs rulesets are enforced). 2. Jailed uid-0 process (jail(2) v1, path=/jail) OPENED /dev/devfs — the only gate is 0600 root:wheel, which jailed uid 0 passes. devfs_dev_ioctl() (devfs_rules.c:419) has no priv_check()/jail check whatsoever. 3. A jailed-issued SHOW rule + APPLY "*" un-hid /dev/mem inside the jail. 4. JAIL-ESCAPE marker: un-hid and OPENED /dev/zero from inside the jail — the host's devfs ruleset was fully defeated from within the jail. 5. Cross-mount write: a jailed-issued PERM rule (mntpoint "/dev") changed the HOST's /dev/console from 0600 to 0666. 6. /dev/mem un-hid + stat-able from the jail; only memio(4)'s own jailed() check (EPERM) stopped the read — a driver-level defense devfs lacks.

Impact: jail escape. Any jail whose devfs does not hide the devfs control node (this guest ships no /etc/devfs.rules, so a plain jail devfs exposes it; same for custom rulesets that forget it) lets jailed root un-hide arbitrary devices in its own mount and rewrite permissions/visibility on the host's and every other jail's devfs mounts. Devices whose drivers lack their own jailed() checks are then openable (demonstrated with /dev/zero; /dev/mem is stopped only by memio).

Privilege ceiling note: on a non-jail system the ioctls are root-only (0600 node) — the security boundary actually broken here is the jail boundary (jailed root != host root).

Fix validated: fixed kernel returns EPERM to the jailed caller (fix.diff, jailed(curthread->td_ucred) gate in devfs_dev_ioctl); run.fixed.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.