DF-3224 — /proc/pid/ctl signal delivery performs no authorization (bypasses kill(2)'s CANSIGNAL: p_trespass + reaper_sigtest + pid-1 gate)

File: sys/vfs/procfs/procfs_ctl.c:319-337 (procfs_doctl, signal branch) Severity: Medium — authorization bypass (CWE-862), unprivileged local Status: REPRODUCED on DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS), 2 independent runs (before and after a clean-snapshot reset), both deltas.

What the bug is

Writing a signal name (e.g. "term", "kill") to /proc/<pid>/ctl reaches procfs_doctl(). When the writer is not the tracer of a stopped tracee (TRACE_WAIT_P false), the only branch taken is:

} else {
    ksignal(p, nm->nm_val);      /* procfs_ctl.c:333 — NO permission check */
}
error = 0;

ksignal() is the raw delivery primitive with zero checks inside (kern_sig.c:1118). Every gate that kill(2) applies in kern_kill() (kern_sig.c:803 CANSIGNAL(p, sig, 1)) is skipped:

• p_trespass() (kern_prot.c:1023) — uid/ruid rules incl. full-cred-drop cases;
• reaper_sigtest() (kern_fork.c:1285) — DragonFly's reaper-subtree signal scoping;
• the pid == 1 NOREBOOT capability gate (kern_sig.c:786).

The only authorization that ever happens is the open-time vnode check: /proc/<pid>/ctl is mode 0200 with va_uid = target's current effective uid (procfs_subr.c:216, procfs_vnops.c:607), enforced once at open; P_SUGID targets have the write bits stripped only for new getattr/open calls (procfs_vnops.c:584-588). A pre-opened fd keeps write permission across any later credential transition of the target.

Reproduced deltas (both unprivileged, uid 1001)

1. Reaper-subtree bypass (fully unprivileged). A same-uid attacker inside a PROC_REAP_ACQUIRE subreaper subtree cannot kill(2) a same-uid process outside it (reaper_sigtest → EPERM, enforcement working as designed), yet write("term\n") to /proc/<victim>/ctl delivers SIGTERM. This defeats the reaper isolation boundary exactly where it is designed to protect (supervised/sandboxed same-uid service trees).
2. Kill of a root process after credential sanitization. Attacker opens the ctl fd while the victim is uid 1001; victim execs a setuid-root helper that fully drops credentials (setresuid(0,0,0), su/login-style). kill(2) returns EPERM (all four uid combinations fail in p_trespass); the stale ctl fd still delivers SIGKILL — the now-root process dies.

Files

• df3224.c — PoC (part 1 unprivileged; part 2 takes the setuid helper path)
• dropdemo.c — setuid-root credential-drop helper (one-time root install: cc -o dropdemo dropdemo.c && chown root:wheel dropdemo && chmod 4555 dropdemo)
• build.log, run.log, run.2.log — full logs (run.2 = after clean-snapshot reset)
• fix.diff — verified fix (CANSIGNAL gate, mirrors kern_kill)
• verdict.json, manifest.json

Build & run

cc -O -o df3224 df3224.c
cc -O -o dropdemo dropdemo.c && chown root:wheel dropdemo && chmod 4555 dropdemo   # root, once
./df3224 /full/path/to/dropdemo      # or without arg for part 1 only

Expected (vulnerable): part 1 kill → REFUSED (Operation not permitted) then ctl write → DELIVERED, victim exits 57 (42+15); part 2 kill → REFUSED then root-dropped victim KILLED by signal 9 via /proc ctl.

Expected (patched fix.diff): ctl writes fail with EPERM; victims survive.

DF-3224 VERDICT — REPRODUCED (authorization bypass, unprivileged)

Bottom line

procfs_doctl()'s signal branch (sys/vfs/procfs/procfs_ctl.c:333) calls ksignal() with no authorization whatsoever. kill(2)'s entire permission model — p_trespass() uid rules, reaper_sigtest() reaper-subtree scoping, and the pid-1 NOREBOOT capability gate, all bundled in CANSIGNAL() (sys/signal2.h:46-49, enforced at sys/kern/kern_sig.c:803) — is bypassed by any unprivileged process that can open /proc/<pid>/ctl (mode 0200, owner = target's current euid; checked only at open time). Two deltas demonstrated as uid 1001 on DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC (INVARIANTS):

1. Reaper isolation bypass — attacker inside a PROC_REAP_ACQUIRE subreaper subtree: kill(victim, SIGTERM) → EPERM; ctl write "term" → SIGTERM delivered (victim's handler ran, exit 57). run.log + run.2.log.
2. Post-credential-change kill of a root process — ctl fd opened while victim euid==1001; victim execs setuid-root helper + setresuid(0,0,0); kill(victim, SIGKILL) → EPERM; stale fd write "kill" → root-dropped process SIGKILLed. run.log + run.2.log.

Both reproduced identically on two independent boots (second run after vm.sh reset with-src), so the result is not snapshot-specific.

Why it works (path:line)

• procfs_doctl signal branch: sys/vfs/procfs/procfs_ctl.c:319-337 — else { ksignal(p, nm->nm_val); } error = 0; — no cred/reaper/cap check.
• ksignal is the raw primitive: sys/kern/kern_sig.c:1118-1121.
• kill(2) gate that is skipped: sys/kern/kern_sig.c:801-809 (CANSIGNAL), macro at sys/sys/signal2.h:46-49 → p_trespass (sys/kern/kern_prot.c:1023)
• reaper_sigtest (sys/kern/kern_fork.c:1285-1312) + pid-1 NOREBOOT cap (kern_sig.c:786).
• The only gate ever applied is open-time vnode perms: ctl mode 0200 (sys/vfs/procfs/procfs_subr.c:213-217), owner = target current euid (sys/vfs/procfs/procfs_vnops.c:607), enforced by VOP_ACCESS at open only; P_SUGID bit-stripping (procfs_vnops.c:584-588) affects only new opens — a pre-opened fd keeps working after the target goes setuid-root.

Impact ceiling

Any of the 32 signals (SIGKILL/SIGSTOP/SIGCONT included) delivered to any process whose euid matched the attacker's at fd-open time, regardless of the kernel's signal ACLs: supervised same-uid service trees (reaper scoping), processes that sanitized credentials after start (su/login-style full drops), pid 1 from NOREBOOT-restricted-root contexts. Availability/integrity attack on privileged processes (kill/stop/cont), no memory corruption and no uid0 route.

Fix

fix.diff adds CANSIGNAL(p, nm->nm_val, 1) — the exact kern_kill() gate — before ksignal(). Validated by rebuild + re-run (see verdict.json fix_status): patched kernel refuses the ctl signal with EPERM in both delta scenarios while kill(2) semantics are unchanged.

Reproduce

See README.md; run.log (first boot) and run.2.log (fresh clean-source snapshot) contain the decisive output.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.