From nobody Tue Sep 29 15:59:17 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hvNCT4xkxz6tlGm for ; Tue, 29 Sep 2026 15:59:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hvNCT2fghz4dpS for ; Tue, 29 Sep 2026 15:59:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790697557; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RWpfXz/kp4VfBjM7E/L5txo1PH4B5jiujCSWcnkpyIE=; b=dJCJoOrgP8lP1MKvGJZh1PNDToyi/GP7uUstlXp/xiYNesH/dGw1yH2aJhdB5c91vq9EhR Smf7pJWXSFxDbUGgOXOhpFepf7FjRTf87LchMgNoDmsZSh75MySqw4ABsKCHZHOXsLHLDn TiQdfvwrN4sxqSj0W7elQluwik6kNcaJhKwzMcONs4oRUxpdoACWUWwvmGN3G10PCeTxx6 1MUSSZmZcIEFU1we0ovLDP0MykDtOrtgwaB/2jdiFbtD6UlGFZjutvRyFpH7id/BqgSw+M GEiXDQhDLpzzQbuBWJ6EwA2tfbG0kByoIOvUE3UTcicbl37CG0UW00Fqs/0HeQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790697557; b=j7+QRFN/KqKP637E/rZ0/pok3sayW+CZbN8ngsF40JKIwkFVCm2f6wFtj3VVfCfy44tiWu RbB5vIQggau7Bq75U0NnPYGu67SVk/e4MawaDIwizxpTJFUZrfu8bs51nXs1oOWBufQzjX ABS3AW4JGx+H3YH/oiMKatkVvCcAxDzV/gJ8O/D9SKA2NnIz9Lr3SxadhZpVfEd+6myWcj Cc71rY7dnF/kYihm3Bwb/CWhb3hjgBY72wD0UEsMwbPAdlJIExv3hq/fCENEhWxTyeaqyJ txZy90wKSWSDJsSBmS0ymlSnQmOgSTA/QJzbnlxQmln4wM2pYSd637GlTBGFLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790697557; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RWpfXz/kp4VfBjM7E/L5txo1PH4B5jiujCSWcnkpyIE=; b=Q8oUm0m5/OM6zsrjk1ggBjddry7xU80W/eU9jHjBhJwHETlw6lO/WsrefNXeUnHC3Q1kma DPsaWF1yDMW5cRS+SabiblMlFKjYfFj1qDQA0M++w25va7wcw9+MPWf+uJ5SYPGy/e31Ah KXtcwD4+E6JiTQBs94scEDpT92V+afDzRaGHcBs1f5Gh0I7Rd4Li9S9fR1iDGPAiFUeKCG a3L85KNkNRQALPGvau0V4CSl7aQswP8d2Vws818Tir85oY26B4D6O4JqUtnXsO6RzWzZvQ SrYCfULMihfjlSMKshu/ip0LXD4sCm8GYc50UcwZENIKQ95J45hZlG7UPTSEcA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hvNCT1l3Cz1JRW for ; Tue, 29 Sep 2026 15:59:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 25457 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 29 Sep 2026 15:59:17 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 394fb0542a8e - releng/15.0 - vfs: Disallow renameat() with FD_RESOLVE_BENEATH descriptors List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 394fb0542a8e3a15f16388fa3aed3c4045f79325 Auto-Submitted: auto-generated Date: Tue, 29 Sep 2026 15:59:17 +0000 Message-Id: <6abbe055.25457.104f36cb@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=394fb0542a8e3a15f16388fa3aed3c4045f79325 commit 394fb0542a8e3a15f16388fa3aed3c4045f79325 Author: Mark Johnston AuthorDate: 2026-09-28 16:47:56 +0000 Commit: Mark Johnston CommitDate: 2026-09-28 18:14:40 +0000 vfs: Disallow renameat() with FD_RESOLVE_BENEATH descriptors The FD_RESOLVE_BENEATH flag was intended to try to resolve bugzilla PR 262179 without entirely disallowing fd passing between jails. However, one can use renameat() to bypass the restriction: upon receiving a directory fd with FD_RESOLVE_BENEATH set, a jailed process can still move its CWD or one of its ancestors to the directory, and just cd out of its jail root. So disallow renameat() when either the source or destination directory fds has FD_RESOLVE_BENEATH set, like we do with fchdir() and fchroot() to prevent similar escapes. Approved by: so Security: FreeBSD-SA-26:66.jail Security: CVE-2026-101305 PR: 262179 Reported by: firk@cantconnect.ru Reviewed by: olce, kib Differential Revision: https://reviews.freebsd.org/D59875 --- lib/libsys/fcntl.2 | 9 ++++++++- sys/kern/vfs_syscalls.c | 9 +++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/lib/libsys/fcntl.2 b/lib/libsys/fcntl.2 index d67c38cfbc6c..8777222798d8 100644 --- a/lib/libsys/fcntl.2 +++ b/lib/libsys/fcntl.2 @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 24, 2025 +.Dd September 22, 2026 .Dt FCNTL 2 .Os .Sh NAME @@ -173,6 +173,13 @@ and similar operations, and opening a directory with .Xr openat 2 where the directory descriptor has the flag set causes the new directory descriptor to also have the flag set. +A file descriptor with the +.Dv FD_RESOLVE_BENEATH +set cannot be used as either the source or target descriptor in +.Xr renameat 2 +or +.Xr renameat2 2 +system calls. .El .It Dv F_SETFD Set flags associated with diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 8295a6d071e7..3531353e303c 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -3814,6 +3814,15 @@ again: } tdvp = tond.ni_dvp; tvp = tond.ni_vp; + if (fvp->v_type == VDIR && + ((fromnd.ni_resflags | tond.ni_resflags) & NIRES_BENEATH) != 0) { + /* + * We must not rename a directory relative to FD_RESOLVE_BENEATH + * descriptors. + */ + error = ENOTCAPABLE; + goto out; + } error = vn_start_write(fvp, &mp, V_NOWAIT); if (error != 0) { again1: