From nobody Tue Sep 29 15:57:35 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hvN9W65KCz6tlJP for ; Tue, 29 Sep 2026 15:57:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hvN9W3HH0z4YTH for ; Tue, 29 Sep 2026 15:57:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790697455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wjMflLPUqBe+lZGql9rQMkqUERR8pi3BiUKyHx7Qd68=; b=lNQN91qq1DkTttMxg8WlWQtT5VyqQraKeUjuHynNE7pBIVVG+A0M2VTZFW8OR0RQ4r922O hw3I49PHWyG/iMBhF0KdIYmcrmVJOpt3S1G9Y10RsJZFyRGRucyu10lpJRoVSBytXYz9LV 3H9qGds54xgnu1aGNiMIQuVQwxjRxNZxK2nGpQ0OA7RCQzIJPfG+uajcz3wLx4N4sLuEtW m6dh52EodGXPQ84LN3iMg8dVbvILv6Bj9dtXYdF8agQYD701v4Qg7F44cAbzDT+3L56UlL uHnP5IC3w0d9D1ZGcp2GTQ2D2gqStmA3uVk94yAcyHAgkcTY75yxvrqzwarEkQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790697455; b=ha11qIOMU1SKesurMbYVJGd1zwQBV1MNxYdv4VkYkzGUWrxkemOyfJaXIYilr4ipNW0XQ3 FgCGFo9OZ3ZiLeJgFXRC9+BR62ST/t1K4eW+nW+LoDkkP8sJKx8u3x6zrr7isy2FF8Dn3/ cdzDXqsLo2aCWvOYr4A1//yQ8plRojuw5ga9qJ+BJuv3HOTbc2ME39Lh1Qymjl1HsN3q38 NpumMLlf8vRlFQ/xLNx5sVNipJDS0s/9f6+H+33S6v9cNEvjzut3cga1N4bWIrq5+MJvwB Ir/9JAyYv4P1IYS9+p0oSxNrBf6sLd4zP+fVggZhnzEfJ4R2AVIGfuxqQ1L4ug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790697455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wjMflLPUqBe+lZGql9rQMkqUERR8pi3BiUKyHx7Qd68=; b=ocjLWF2qOEeLwBr6WNfYHqFiMAyk/1yIab6YU4c0i7A+hrUKp+DqfpECvGot/u7+MsgQrm yfmZQSAalG2sg7i+YQVTdU60AaugZKee19Bz+3S5c88qtiNohpjZEL88zZm7Ezgwc05rX2 1wUn8TtiWDXWqLVzr5yRRguOXwQtUkBHKJGsssMWTlEM7lsVKfwVAAXbU2Zrj9ET4M7USc xK2eamlxkMGq4qRqWd1Y4+Gbw7IeAauoqwS0iw9HfUXaR4LVs1k6JgNBzvDA6jxFLsuEuK gaWnUBFYunWNsek+X+t54puuBnr2eBkpdsVGaHVtLNsV0GPLGv5mePtNEBBVzQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hvN9W2MVlz1K2Q for ; Tue, 29 Sep 2026 15:57:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 261ea by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 29 Sep 2026 15:57:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 9d0644e7a4f5 - releng/14.4 - unix: Preserve FD_RESOLVE_BENEATH when passing an fd List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 9d0644e7a4f526f12003d776c2224baaa10c1ade Auto-Submitted: auto-generated Date: Tue, 29 Sep 2026 15:57:35 +0000 Message-Id: <6abbdfef.261ea.1af9b936@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9d0644e7a4f526f12003d776c2224baaa10c1ade commit 9d0644e7a4f526f12003d776c2224baaa10c1ade Author: Mark Johnston AuthorDate: 2026-07-24 20:06:05 +0000 Commit: Mark Johnston CommitDate: 2026-09-28 18:17:20 +0000 unix: Preserve FD_RESOLVE_BENEATH when passing an fd The FD_RESOLVE_BENEATH flag is supposed to be sticky. It's set when you receive an fd from a different jail and preserved by openat() etc.. However, if you send the fd to yourself, the flag is stripped since SCM_RIGHTS message don't preserve file descriptor flags. Fix this by preserving those flags and checking for UF_RESOLVE_BENEATH in restrict_rights(). Approved by: so Security: FreeBSD-SA-26:66.jail Security: CVE-2026-101306 Fixes: 350ba9672a7f ("unix: Set O_RESOLVE_BENEATH on fds transferred between jails") Reviewed by: kib MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58317 (cherry picked from commit 586e2b3d89d6e70ab7e4a88497b5f36d78719423) (cherry picked from commit 441885dcfff33d6ca797d54b6bda9dc5fd8eda89) --- sys/kern/uipc_usrreq.c | 27 +++++++++++++++++++-------- tests/sys/kern/unix_passfd_test.c | 31 +++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+), 8 deletions(-) diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index 4df36221bc6a..05381ca08af9 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -2433,15 +2433,25 @@ unp_freerights(struct filedescent **fdep, int fdcount) free(fdep[0], M_FILECAPS); } -static bool -restrict_rights(struct file *fp, struct thread *td) +/* + * Flags to set on the receiving side when externalizing a file descriptor. + * When transferring fds between jails, ensure that the receiver cannot use + * a dirfd to escape the jail chroot. + */ +static int +externalize_fdflags(struct filedescent *fde, struct thread *td) { struct prison *prison1, *prison2; - prison1 = fp->f_cred->cr_prison; + if ((fde->fde_flags & UF_RESOLVE_BENEATH) != 0) + return (O_RESOLVE_BENEATH); + prison1 = fde->fde_file->f_cred->cr_prison; prison2 = td->td_ucred->cr_prison; - return (prison1 != prison2 && prison1->pr_root != prison2->pr_root && - prison2 != &prison0); + if (prison1 != prison2 && prison1->pr_root != prison2->pr_root && + prison2 != &prison0) + return (O_RESOLVE_BENEATH); + else + return (0); } static int @@ -2506,9 +2516,9 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags) struct file *fp; fp = fdep[i]->fde_file; - _finstall(fdesc, fp, *fdp, fdflags | - (restrict_rights(fp, td) ? - O_RESOLVE_BENEATH : 0), &fdep[i]->fde_caps); + _finstall(fdesc, fp, *fdp, + fdflags | externalize_fdflags(fdep[i], td), + &fdep[i]->fde_caps); unp_externalize_fp(fp); } @@ -2744,6 +2754,7 @@ unp_internalize(struct mbuf **controlp, struct thread *td, fdep[i]->fde_file = fde->fde_file; filecaps_copy(&fde->fde_caps, &fdep[i]->fde_caps, true); + fdep[i]->fde_flags = fde->fde_flags; unp_internalize_fp(fdep[i]->fde_file); } FILEDESC_SUNLOCK(fdesc); diff --git a/tests/sys/kern/unix_passfd_test.c b/tests/sys/kern/unix_passfd_test.c index dd68020e1bc4..9a5a3da71c96 100644 --- a/tests/sys/kern/unix_passfd_test.c +++ b/tests/sys/kern/unix_passfd_test.c @@ -1076,6 +1076,36 @@ ATF_TC_CLEANUP(cross_jail_dirfd, tc) err(1, "jail_remove"); } +/* + * Verify that FD_RESOLVE_BENEATH is preserved when an fd is passed over a UNIX + * domain socket. + */ +ATF_TC_WITHOUT_HEAD(resolve_beneath_preserved); +ATF_TC_BODY(resolve_beneath_preserved, tc) +{ + int fd[2], getfd, putfd, fdflags; + + domainsocketpair(fd); + tempfile(&putfd); + + fdflags = fcntl(putfd, F_GETFD); + ATF_REQUIRE(fdflags != -1); + ATF_REQUIRE(fcntl(putfd, F_SETFD, fdflags | FD_RESOLVE_BENEATH) != -1); + ATF_REQUIRE((fcntl(putfd, F_GETFD) & FD_RESOLVE_BENEATH) != 0); + + sendfd(fd[0], putfd); + recvfd(fd[1], &getfd, 0); + + fdflags = fcntl(getfd, F_GETFD); + ATF_REQUIRE(fdflags != -1); + ATF_REQUIRE_MSG((fdflags & FD_RESOLVE_BENEATH) != 0, + "FD_RESOLVE_BENEATH was not preserved across SCM_RIGHTS transfer"); + + ATF_REQUIRE(close(putfd) == 0); + ATF_REQUIRE(close(getfd) == 0); + closesocketpair(fd); +} + ATF_TP_ADD_TCS(tp) { @@ -1095,6 +1125,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, copyout_rights_error); ATF_TP_ADD_TC(tp, empty_rights_message); ATF_TP_ADD_TC(tp, cross_jail_dirfd); + ATF_TP_ADD_TC(tp, resolve_beneath_preserved); return (atf_no_error()); }