DF-5684 — sys_vquotactl() has no privilege check: unprivileged quota-limit manipulation → system-wide write DoS

What

sys_vquotactl() (sys/kern/vfs_quota.c:328-413) dispatches quota commands with no priv_check of any kind:

• set limit (vfs_quota.c:273-284) — sets mount-wide ac_limit
• set limit uid (vfs_quota.c:287-305) — per-uid limit, any uid
• set limit gid (vfs_quota.c:308-326) — per-gid limit, any gid
• set usage all (vfs_quota.c:219-270) — wipes/rewrites all accounting
• get usage all (vfs_quota.c:175-216) — reads usage of every uid/gid

Enforcement is universal once the feature is enabled: vfs_init.c:431-432 installs vfs_stdac_init on every filesystem, and vop_write (vfs_vopops.c:472-491) consults vq_write_ok() for every regular file write, returning EDQUOT — with no privilege bypass for root.

Classic quotactl(2) enforces quota privilege inside the per-FS code (PRFIV_VFS_QUOTA equivalent); vquotactl(2) simply forgot it.

Reproduce (baseline)

Guest booted with vfs.quota_enabled=1; run everything as unprivileged uid 1001 (maxx):

$ echo before >> /root/df5684.txt && echo ROOT_WRITE_OK_BEFORE # as root ROOT_WRITE_OK_BEFORE $ vquota limit / 1 # AS UID 1001: set mount-wide limit = 1 byte setlimit_rc=0 $ vquota show / # AS UID 1001 total: 0, limit = 1 # now as ROOT: $ echo after >> /root/df5684.txt echo: write error on stdout ROOT_WRITE_BLOCKED_RC=2 $ vquota ulim / root 1 # AS UID 1001: target root's uid specifically maxx set uid-root limit=1 rc=0 $ echo rootwrite >> /root/df5684.txt # as root ROOT_APPEND_BLOCKED $ vquota ulim / root 0 && vquota limit / 0 # attacker can also lift it restored $ echo ok >> /root/df5684.txt && echo ROOT_APPEND_OK_AFTER_RESTORE ROOT_APPEND_OK_AFTER_RESTORE

(In-place overwrite with delta=0 still passes — vq_write_ok only blocks net growth — which is why dd conv=notrunc succeeded while appends failed.)

Expected output (patched kernel, fix.diff applied)

$ vquota limit / 1 # as uid 1001 send_command: vquotactl = -1 Failed to send message to kernel maxx_setlimit_rc=1 # EPERM before any state change $ echo ... >> /root/df5684.txt # as root ROOT_WRITE_OK_ON_PATCHED $ vquota limit / 1 && vquota show / && vquota limit / 0 # as root root_setlimit_rc=0 / total: 0, limit = 1 / root_limit_restored

Files

• vq_priv.sh unprivileged part (set limit / ulim / show / sync)
• fix.diff minimal privilege-check fix (git-applyable)
• run.log baseline capture (maxx sets limits, root blocked)
• run.patched.log fix validation capture
• VERDICT.md / manifest.json / verdict.json

DF-5684 VERDICT

Status: REPRODUCED (unprivileged authorization bypass → persistent write DoS for all users incl. root) — FIXED by fix.diff (validated on rebuilt kernel)

Environment

Same guest as DF-5683: DragonFly 6.5-DEVELOPMENT x86_64, baseline kernel #0 (Jul 2 2026) / patched kernel #1 (Oct 10 00:36:54 2026), vfs.quota_enabled=1 boot tunable (feature default-off).

Chain (baseline kernel)

1. uid 1001 maxx calls vquota limit / 1 → sys_vquotactl has no privilege check (vfs_quota.c:328-413) → cmd_set_limit writes mp->mnt_acct.ac_limit = 1 (vfs_quota.c:273-284). rc=0.
2. Every subsequent regular-file write on the mount by ANY user (root included) goes through vop_write → vq_write_ok (vfs_vopops.c:489): ac_bytes + delta > ac_limit → EDQUOT → write(2) fails.
3. Demonstrated: root append to /root/df5684.txt fails ("write error"), after having succeeded seconds earlier.
4. Same for per-uid targeting: vquota ulim / root 1 as maxx → root's own appends blocked (ROOT_APPEND_BLOCKED), lifted by maxx (ulim / root 0).
5. vquota show / as maxx returns every uid/gid's usage (info disclosure of accounting data); sync (set usage all) wipes accounting.
6. Effect persists until an attacker-chosen lift or reboot — a persistent filesystem-write DoS of the whole root mount, executed by an unprivileged user. No root escape needed for impact; combined with any local setuid-root write (e.g. passwd(1), periodic scripts), it also breaks system maintenance entirely.

Why beyond DF-2231

DF-2231 = memory-safety/DoS of the prop copyin primitive itself. This is the missing-authorization defect of the syscall consuming it — the object is parsed fine; the command should never have been executable by uid 1001.

Fix validation

fix.diff adds caps_priv_check_td(curthread, SYSCAP_NOQUOTA_WR) right after the vfs_quota_enabled gate (the same capability classic quota operations require), plus the missing if (error) return after the plistref copyin.

Patched kernel #1: - vquota limit / 1 as maxx → "send_command: vquotactl = -1", rc=1 (EPERM); mount state unchanged; root writes unaffected (ROOT_WRITE_OK_ON_PATCHED). - Regression: root can still set/lift limits (root_setlimit_rc=0, limit = 1 observed via vquota show, restored to 0).

kernel_refs

sys/kern/vfs_quota.c:328-413 (no priv_check), :273-284, :287-305, :308-326, :219-270 sys/kern/vfs_vopops.c:472-491 (EDQUOT enforcement, no root bypass) sys/kern/vfs_init.c:431-432 (feature applies to every filesystem) sys/sys/caps.h:173 (SYSCAP_NOQUOTA_WR — the capability the fix enforces)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.