git: cf0f693f0361 - main - vfs_syscall.c: EXTERROR-ise EPERM from chroot(2)

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=cf0f693f0361e76517cabc234321ce7870fa8f9f

commit cf0f693f0361e76517cabc234321ce7870fa8f9f
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2025-08-02 18:01:06 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2025-08-02 23:28:00 +0000

    vfs_syscall.c: EXTERROR-ise EPERM from chroot(2)
    
    Reviewed by:    emaste, kevans
    Sponsored by:   The FreeBSD Foundation
    Differential revision:  https://reviews.freebsd.org/D51708
---
 sys/kern/vfs_syscalls.c | 12 ++++++++++--
 sys/sys/exterr_cat.h    |  1 +
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index a0e56a8fd8a7..9704e9c160a8 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -37,6 +37,7 @@
 #include "opt_capsicum.h"
 #include "opt_ktrace.h"
 
+#define	EXTERR_CATEGORY		EXTERR_CAT_VFSSYSCALL
 #include <sys/systm.h>
 #ifdef COMPAT_FREEBSD11
 #include <sys/abi_compat.h>
@@ -46,6 +47,7 @@
 #include <sys/capsicum.h>
 #include <sys/disk.h>
 #include <sys/dirent.h>
+#include <sys/exterrvar.h>
 #include <sys/fcntl.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
@@ -982,8 +984,14 @@ kern_chroot(struct thread *td, struct vnode *vp)
 	error = priv_check(td, PRIV_VFS_CHROOT);
 	if (error != 0) {
 		p = td->td_proc;
-		if (unprivileged_chroot == 0 ||
-		    (p->p_flag2 & P2_NO_NEW_PRIVS) == 0) {
+		if (unprivileged_chroot == 0) {
+			error = EXTERROR(EPERM,
+		    "security.bsd.unprivileged_chroot sysctl not enabled");
+			goto e_vunlock;
+		}
+		if ((p->p_flag2 & P2_NO_NEW_PRIVS) == 0) {
+			error = EXTERROR(EPERM,
+			    "PROC_NO_NEW_PRIVS not enabled");
 			goto e_vunlock;
 		}
 	}
diff --git a/sys/sys/exterr_cat.h b/sys/sys/exterr_cat.h
index 80cff53b3576..43f31e1d5dd6 100644
--- a/sys/sys/exterr_cat.h
+++ b/sys/sys/exterr_cat.h
@@ -20,6 +20,7 @@
 #define	EXTERR_CAT_GENIO	6
 #define	EXTERR_CAT_BRIDGE	7
 #define	EXTERR_CAT_SWAP		8
+#define	EXTERR_CAT_VFSSYSCALL	9
 
 #endif