DF-5741 — every raw HCI socket gets HCI_PRIVILEGED: privilege check

evaluated on the netmsg port instead of the caller

Production code: sys/netbt/hci_socket.c:644

if (curproc == NULL || caps_priv_check_self(SYSCAP_RESTRICTEDROOT) == 0)
    pcb->hp_flags |= HCI_PRIVILEGED;

hci_sattach (like every HCI usrreq) runs as a netmsg on the socket's protocol port = netisr_cpuport(0) (uipc_socket.c:259). On that thread: * curproc (curthread->td_proc) is NULL → first arm TRUE; * caps_priv_check_self() → caps_priv_check_td(curthread) (kern_caps.c:343-352) returns 0 (privileged) for any thread with td_lwp == NULL — a netisr kernel thread has none → second arm TRUE regardless of the caller.

Result: the opcode/event/ACL-SCO security filter for unprivileged users (hci_socket.c:510-514, 961-980) is dead code on DragonFly. Verified live on the guest: uid 1001 queued HCI_CMD_RESET (privileged-only opcode, hci_cmds[] length -1) with errno=0 (run.log).

Also affected: the five caps_priv_check_self() gates in sys/netbt/hci_ioctl.c:224,249,259,273,287 (SIOCSBTFLAGS/SIOCSBTPOLICY/ SIOCSBTMASK/...) — they run through hci_scontrol (hci_socket.c:608-616) on the same netmsg port, so unprivileged users can also flip unit flags/policy via ioctl.

Threat model: any local user on a machine with a Bluetooth controller: full controller takeover from uid!=0 (RESET/DoS, WRITE_SCAN_ENABLE, WRITE_AUTH_ENABLE, link-key management commands) and, via the same flag in hci_mtap (hci_socket.c:961-980), disclosure of HCI_EVENT_RETURN_LINK_KEYS / LINK_KEY_NOTIFICATION / USER_PASSKEY_NOTIFICATION events — i.e. stored Bluetooth link keys and passkeys — by socket option, without any privilege.

Reproduce (needs the DF-5740 rig loaded + hw.hsh_setup=1)

sh build.sh
su maxx -c ./bypass       # baseline: "*** PRIVILEGE BYPASS ***"
# apply fix.diff to /usr/src/sys/netbt, rebuild rig (DF-5740 build.sh):
su maxx -c ./bypass       # fixed: RESET -> EPERM

See run.log for both transcripts (root control included).

DF-5741 — VERDICT

Reproduced: yes — deterministic (not a race). Unprivileged uid 1001 opened a raw HCI socket through the verbatim production hci_sattach and queued HCI_CMD_RESET (a privileged-only opcode; the hci_cmds[] security table marks it length -1) with errno=0. Kernel state confirmed the command landed on unit->hci_cmdwait (harness state dump 15→17). No special timing.

Root cause (both arms of the check grant): - hci_socket.c:644 curproc == NULL — true on the netisr port thread; - caps_priv_check_self() → caps_priv_check_td(curthread) → kern_caps.c:348 if (td->td_lwp == NULL) return 0; — true for the netisr thread. The imported NetBSD code assumed pru_attach executes on the user's syscall thread; DragonFly's netmsg port serialization moved it.

Impact: security-filter bypass — unprivileged local user gains full HCI controller command access + privileged event/packet tap (including link-key/passkey disclosure events) on any machine with a Bluetooth controller. Also disables the five privilege gates in hci_ioctl.c (reached via hci_scontrol from this file).

Fix validated: caps_priv_check(so->so_cred, SYSCAP_RESTRICTEDROOT) (credential captured from the creating user thread in socreate) — after the fix: uid1001 → EPERM on RESET; uid0 → unchanged (run.log second half). The same conversion should be applied to hci_ioctl.c:224,249,259,273,287 (out of this file's scope; noted).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.