From nobody Tue Jun 30 17:21:59 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLw3KBPz6jYp8 for ; Tue, 30 Jun 2026 17:22:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLv4mf1z3spZ for ; Tue, 30 Jun 2026 17:21:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840119; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dXlkIGTsKUzlDn9mJE+o9cZvrBmIacPVy5L4mzBApVg=; b=h3YjEXfMr5wCTN6fgh1GEN6/Fx+cU1FSZSP77ZiGMCnFT0gXn8zoiTZy1lXWLrOGjUH337 CSpm5a7uV4QFTxcQBji7lIVufL6O7OK7MpWlvdBcmYHVYxRaLwUyjJN94REtiwzwr+bE6m DUHaXXKxIVajP7ZsIJeITaOcS4ruIjR/BPrpdn01q4nV3o7jv89Ye4fHl+690WxdlYdJdt YWsDhPzjJyzlr4HeAyVv1chD4sSpMMvE2UQGBmqSttDzf36feVVJzDvodyqAFZ7nqEJ1ms Fvpqj6/+Rpav5apRBXCm5lJeOlDyPz5564BVIs1ttXqS3hoMW0d/9vtHcOqMrA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840119; a=rsa-sha256; cv=none; b=DJPU4cXMxlhvpG38QahpEJDH8t1KK9gDd4Ile3pdKhGnN9NajPDd0MzHO/AWHRJhwTH3Fn MTdkVdhqdYlESlr4i374E+KpcANsbxNotHyqL8oT8WaVX5PArFlc7G9SHFK93dyhzDhgS8 qudKm3e6MvUDydY9Sl7DjDLNnj8Pp+jiJAtfIqLgSfh7Q42wXlLoGdSOjJvjtX2vc8Nyl2 kRimZS2xaE/WivOep4eA1MwgHjt5DpUFLRg2MAem4bGJhPmQKKNc1pdJAIOIn00kl/kRVp X1VMPkmFTGgERJaXvGEQo9ignCb3AT9q1Nk6nkH9ognZs+7Vml6JNw01R3cQxw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840119; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dXlkIGTsKUzlDn9mJE+o9cZvrBmIacPVy5L4mzBApVg=; b=fenrXabU74OiXTuhiKGLif6ZM4NRkcrVtiGDy9j0BbOE8AZY/Stv7OqnKqigwwvWFfYhYz nhTsn2nBGZkFPrw5WPbAeMK4jlAlke7HN71zd5BlqD7Aq4atej9fqem8OMCdrvOz1cvHtQ s8gsoPJzA22273+ga7Xf2XNSDh0UxG2R/X5Ixotw1VP9Ep6/pfx4Gm5MFzGT3dM0/6q6HI BwKxCkyQjhx83FvgX46yBnfUPumsFZjwPwJPWnuQWfpIe1Oi9fT7g2HYjZNneWpAmJ0DiN wTbux3PYN4V5ReBnhC3B1eZhfr60RXNCI4XQGkhelBAG3ignZMKtwVwr7ysH/g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLv3dLdztnk for ; Tue, 30 Jun 2026 17:21:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4587d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 63a8e7bc0412 - releng/15.1 - unlinkat: Pass flags down to the work functions List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 63a8e7bc0412f6d3d113839ed9e83e5c4bf8fd39 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:59 +0000 Message-Id: <6a43fb37.4587d.234c01f4@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=63a8e7bc0412f6d3d113839ed9e83e5c4bf8fd39 commit 63a8e7bc0412f6d3d113839ed9e83e5c4bf8fd39 Author: Mark Johnston AuthorDate: 2026-06-23 20:43:53 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 unlinkat: Pass flags down to the work functions The unlinkat(2) and funlinkat(2) system calls were ignoring AT_RESOLVE_BENEATH. Also pass pathseg through instead of assuming it's UIO_USERSPACE. Add some tests which make sure that AT_RESOLVE_BENEATH is handled properly by various system calls. Approved by: so Security: FreeBSD-SA-26:42.unlinkat Security: CVE-2026-49421 Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57790 --- sys/kern/vfs_syscalls.c | 11 +- tests/sys/kern/Makefile | 1 + tests/sys/kern/resolve_beneath_test.c | 220 ++++++++++++++++++++++++++++++++++ 3 files changed, 227 insertions(+), 5 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index dc02e3351fee..a7e708181cdf 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1976,16 +1976,17 @@ sys_unlink(struct thread *td, struct unlink_args *uap) static int kern_funlinkat_ex(struct thread *td, int dfd, const char *path, int fd, - int flag, enum uio_seg pathseg, ino_t oldinum) + int flags, enum uio_seg pathseg, ino_t oldinum) { - if ((flag & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) + if ((flags & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) return (EINVAL); - if ((flag & AT_REMOVEDIR) != 0) - return (kern_frmdirat(td, dfd, path, fd, UIO_USERSPACE, 0)); + if ((flags & AT_REMOVEDIR) != 0) + return (kern_frmdirat(td, dfd, path, fd, pathseg, + flags & ~AT_REMOVEDIR)); - return (kern_funlinkat(td, dfd, path, fd, UIO_USERSPACE, 0, 0)); + return (kern_funlinkat(td, dfd, path, fd, pathseg, flags, 0)); } #ifndef _SYS_SYSPROTO_H_ diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 599ccc6519e6..7f8aaff2ed47 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -39,6 +39,7 @@ ATF_TESTS_C+= procdesc ATF_TESTS_C+= ptrace_test TEST_METADATA.ptrace_test+= timeout="15" ATF_TESTS_C+= reaper +ATF_TESTS_C+= resolve_beneath_test ATF_TESTS_C+= sched_affinity ATF_TESTS_C+= shutdown_dgram ATF_TESTS_C+= sigaltstack diff --git a/tests/sys/kern/resolve_beneath_test.c b/tests/sys/kern/resolve_beneath_test.c new file mode 100644 index 000000000000..b83926038ded --- /dev/null +++ b/tests/sys/kern/resolve_beneath_test.c @@ -0,0 +1,220 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was written by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +#include +#include + +#include +#include +#include + +#include + +/* + * Verify that AT_RESOLVE_BENEATH is respected by various system calls. + */ + +static int +setup(void) +{ + int fd, tfd; + + ATF_REQUIRE_EQ(0, mkdir("base", 0755)); + ATF_REQUIRE_EQ(0, mkdir("outside", 0755)); + ATF_REQUIRE((tfd = open("outside/target", O_CREAT | O_WRONLY, 0644)) >= + 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("outside/dir", 0755)); + ATF_REQUIRE((tfd = open("base/file", O_CREAT | O_WRONLY, 0644)) >= 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("base/subdir", 0755)); + ATF_REQUIRE((fd = open("base", O_DIRECTORY | O_RDONLY)) >= 0); + return (fd); +} + +ATF_TC_WITHOUT_HEAD(faccessat_beneath); +ATF_TC_BODY(faccessat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + faccessat(fd, "file", F_OK, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + faccessat(fd, "../outside/target", F_OK, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(chflagsat_beneath); +ATF_TC_BODY(chflagsat_beneath, tc) +{ + int fd, ret; + + fd = setup(); + ret = chflagsat(fd, "file", UF_NODUMP, AT_RESOLVE_BENEATH); + if (ret != 0) + ATF_REQUIRE_EQ(EOPNOTSUPP, errno); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + chflagsat(fd, "../outside/target", UF_NODUMP, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchmodat_beneath); +ATF_TC_BODY(fchmodat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchmodat(fd, "file", 0644, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchmodat(fd, "../outside/target", 0644, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchownat_beneath); +ATF_TC_BODY(fchownat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchownat(fd, "file", -1, -1, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchownat(fd, "../outside/target", 0, 0, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(utimensat_beneath); +ATF_TC_BODY(utimensat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + utimensat(fd, "file", NULL, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + utimensat(fd, "../outside/target", NULL, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(linkat_beneath); +ATF_TC_BODY(linkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + linkat(fd, "file", fd, "hardlink", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + linkat(fd, "../outside/target", fd, "hardlink2", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_beneath); +ATF_TC_BODY(unlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "file", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/target", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_rmdir_beneath); +ATF_TC_BODY(unlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "subdir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/dir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_beneath); +ATF_TC_BODY(funlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "file", FD_NONE, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/target", FD_NONE, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_rmdir_beneath); +ATF_TC_BODY(funlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, mkdir("base/subdir2", 0755)); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "subdir2", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/dir", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC(getfhat_beneath); +ATF_TC_HEAD(getfhat_beneath, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(getfhat_beneath, tc) +{ + fhandle_t fh; + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + getfhat(fd, "file", &fh, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + getfhat(fd, "../outside/target", &fh, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TP_ADD_TCS(tp) +{ + ATF_TP_ADD_TC(tp, faccessat_beneath); + ATF_TP_ADD_TC(tp, chflagsat_beneath); + ATF_TP_ADD_TC(tp, fchmodat_beneath); + ATF_TP_ADD_TC(tp, fchownat_beneath); + ATF_TP_ADD_TC(tp, utimensat_beneath); + ATF_TP_ADD_TC(tp, linkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, funlinkat_beneath); + ATF_TP_ADD_TC(tp, funlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, getfhat_beneath); + return (atf_no_error()); +}