[Midnightbsd-cvs] [MidnightBSD/src] 5f7eb7: jail: fix FD_RESOLVE_BENEATH bypasses allowing fil...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 5f7eb70afd7e7b3b7e40a65e395de744f3476df3
      https://github.com/MidnightBSD/src/commit/5f7eb70afd7e7b3b7e40a65e395de744f3476df3
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-01 (Thu, 01 Oct 2026)

  Changed paths:
    M lib/libc/capability/cap_rights_init.3
    M lib/libc/sys/fcntl.2
    M sys/fs/fdescfs/fdesc_vnops.c
    M sys/kern/kern_descrip.c
    M sys/kern/subr_capability.c
    M sys/kern/uipc_usrreq.c
    M sys/kern/vfs_syscalls.c
    M sys/sys/capsicum.h
    M sys/sys/filedesc.h
    M tests/sys/fs/Makefile
    A tests/sys/fs/fdescfs/Makefile
    A tests/sys/fs/fdescfs/fdescfs_test.c
    M tests/sys/kern/unix_passfd_test.c

  Log Message:
  -----------
  jail: fix FD_RESOLVE_BENEATH bypasses allowing filesystem root escapes

When a directory file descriptor is passed between jails over a Unix
domain socket, the receiver's copy gets FD_RESOLVE_BENEATH so that
lookups through it cannot leave the directory.  Three flaws let a
jailed process shed that restriction:

- fdescfs(4) mounted with "nodup" returned, for /dev/fd/N, a vnode that
  did not inherit FD_RESOLVE_BENEATH or the Capsicum rights of
  descriptor N.  fdesc_lookup() now propagates both into the enclosing
  nameidata, marking the lookup NIRES_BENEATH and intersecting the
  capability rights, and fails with ENOTCAPABLE when it cannot (no
  enclosing nameidata).  (CVE-2026-101304)

- renameat(2) did not honour FD_RESOLVE_BENEATH on its directory
  arguments, so a directory could be renamed relative to a restricted
  descriptor and then escaped from via fchdir(2).  Renaming a directory
  is now refused with ENOTCAPABLE when either directory descriptor has
  the flag set.  (CVE-2026-101305)

- SCM_RIGHTS did not preserve FD_RESOLVE_BENEATH, so a process could
  clear it by sending the descriptor to itself.  unp_internalize() now
  records the sender's fd flags and unp_externalize() re-applies the
  flag.  (CVE-2026-101306)

Add filecaps_full(), filecaps_intersect() and cap_rights_intersect()
helpers used by the fdescfs change, document the renameat(2)
restriction in fcntl(2) and cap_rights_intersect() in
cap_rights_init(3), and add regression tests for fdescfs and for
FD_RESOLVE_BENEATH preservation over SCM_RIGHTS.

Security:       CVE-2026-101304
Security:       CVE-2026-101305
Security:       CVE-2026-101306
Security:       FreeBSD-SA-26:66.jail
Obtained from:  FreeBSD f89e6b5e03f6, 616f35f932e9, 441885dcfff3,
                666f08d59743, 5f9f2ac707d4
AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: f54ba256b55d93239e110d72e9467dcaa4fd9adf
      https://github.com/MidnightBSD/src/commit/f54ba256b55d93239e110d72e9467dcaa4fd9adf
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-01 (Thu, 01 Oct 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: jail FD_RESOLVE_BENEATH fixes (FreeBSD-SA-26:66.jail)

AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>


Compare: https://github.com/MidnightBSD/src/compare/8ce8fb255412...f54ba256b55d

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications