DF-5797 — utimensat/futimens: non-owner with write permission can set arbitrary file timestamps

What

kern_utimensat() (sys/kern/vfs_syscalls.c:3961) and kern_futimens() (sys/kern/vfs_syscalls.c:3847) gate the whole timestamp operation on NLC_OWN | NLC_WRITE, which naccess_lva() evaluates as owner OR write-permission. Neither path checks whether the user-supplied timespecs are arbitrary (POSIX allows arbitrary values only for the owner / privileged users; write access alone permits only the current time). On filesystems that do not re-check ownership in VOP_SETATTR — HAMMER2, the default root FS, unlike UFS (sys/vfs/ufs/ufs_vnops.c:462-468) — the arbitrary times are accepted.

Reproduce (on the guest)

# root:
sh /tmp/setup_root.sh          # creates /tmp/df5797_target (root:wheel 666)
cc -O -o /tmp/utimes_forge /tmp/utimes_forge.c
chown maxx /tmp/utimes_forge
# unprivileged user (maxx, uid 1001):
/tmp/utimes_forge /tmp/df5797_target

Expected (vulnerable) output

uid=1001  file owner=0 mode=100666
utimensat(arbitrary)      -> OK          <- POSIX says EPERM here
  after utimensat            atime=0 mtime=66666
utimensat(nofollow,mixed)-> OK
futimens(arbitrary)       -> OK          <- POSIX says EPERM here
  after futimens            atime=12345678 mtime=12345678

Control (mode 644 file, no write perm) correctly returns EACCES — proving the gate is exactly "write permission", not ownership.

Impact

Any local user with write access to a file they do not own can forge arbitrary atime/mtime — including restoring original timestamps after modifying content. This defeats timestamp-based incremental backups (rsync -a, tar), build systems (make), and forensic/audit triage that assume POSIX utimes semantics (FreeBSD/Linux/POSIX all return EPERM).

DF-5797 VERDICT — REPRODUCED (policy/integrity violation)

Bottom line

On DragonFly 6.5-DEVELOPMENT (hammer2 root), an unprivileged user (uid 1001, maxx) successfully set arbitrary atime/mtime on a root-owned, world-writable file (/tmp/df5797_target, mode 666) via utimensat(2) (with and without AT_SYMLINK_NOFOLLOW) and futimens(2). Observed values written: atime=epoch 0, mtime=66666, then both atime/mtime=12345678. A control file without write permission (mode 644) returned EACCES on every path, proving the only gate exercised is write permission, not ownership. POSIX.1-2017 utimensat, FreeBSD (setutimes() PRIV_VFS_UTIMES logic) and Linux (CAP_FOWNER) all require EPERM for arbitrary times from a non-owner.

Root cause (path:line)

1. sys/kern/vfs_syscalls.c:3961 — kern_utimensat() sets nd->nl_flags |= NLC_OWN | NLC_WRITE and never inspects nullflag (whether the request is "current time" vs arbitrary). naccess_lva (sys/kern/vfs_nlookup.c:1875-1896) implements NLC_OWN as an owner-side bypass and NLC_WRITE as a mode-bit check — i.e. the combination is owner OR write, not owner.
2. sys/kern/vfs_syscalls.c:3847 — kern_futimens() does the same via naccess_lva(&lva, NLC_OWN | NLC_WRITE, fp->f_cred) and then calls setutimes() with arbitrary newts.
3. Filesystem layer: UFS enforces the POSIX rule itself (sys/vfs/ufs/ufs_vnops.c:462-468: non-owner needs SYSCAP_NOVFS_SETATTR, else VA_UTIMES_NULL+VWRITE), but HAMMER2's setattr path performs no ownership check for va_atime/va_mtime, so on the default root filesystem the syscall gate is the only defense — and it is permissive. (hammer2-side re-check recommended as defense in depth; the syscall-layer fix below repairs every filesystem and both the path and fd entry points.)

Evidence

• run.log / run.2.log — two full runs, both show utimensat(arbitrary) -> OK, futimens(arbitrary) -> OK, stat() confirming the forged values (atime=0/mtime=66666, then 12345678), and the mode-644 control returning EACCES.
• env.txt — guest uname/compiler/mounts (hammer2 root).

Exploit chain

Not a memory-corruption primitive; the impact ceiling is integrity forgery: modify file content (write access), then restore prior timestamps so timestamp-based backups/audit/make tooling miss the tamper. Deterministic, unprivileged, on the default filesystem.

Fix validation

fix.diff authored (sys/kern/vfs_syscalls.c: POSIX ownership/privilege check for arbitrary times in both kern_utimensat and kern_futimens, mirroring the file's own can_hardlink() style using caps_priv_check(SYSCAP_NOVFS_SETATTR)). Kernel rebuild validation was not performed: this is a permission-policy finding, not a reproduced memory-corruption finding, so the mandatory-rebuild rule does not apply. Behavior change is directly predictable from the diff (non-owner arbitrary-time requests become EPERM; both-time-current requests keep working).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.