git: cf0f693f0361 - main - vfs_syscall.c: EXTERROR-ise EPERM from chroot(2)

[Konstantin Belousov]

The branch main has been updated by kib:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=cf0f693f0361e76517cabc234321ce7870fa8f9f

commit cf0f693f0361e76517cabc234321ce7870fa8f9f
Author:     Konstantin Belousov <k...@freebsd.org>
AuthorDate: 2025-08-02 18:01:06 +0000
Commit:     Konstantin Belousov <k...@freebsd.org>
CommitDate: 2025-08-02 23:28:00 +0000

    vfs_syscall.c: EXTERROR-ise EPERM from chroot(2)
    
    Reviewed by:    emaste, kevans
    Sponsored by:   The FreeBSD Foundation
    Differential revision:  https://reviews.freebsd.org/D51708
---
 sys/kern/vfs_syscalls.c | 12 ++++++++++--
 sys/sys/exterr_cat.h    |  1 +
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index a0e56a8fd8a7..9704e9c160a8 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -37,6 +37,7 @@
 #include "opt_capsicum.h"
 #include "opt_ktrace.h"
 
+#define        EXTERR_CATEGORY         EXTERR_CAT_VFSSYSCALL
 #include <sys/systm.h>
 #ifdef COMPAT_FREEBSD11
 #include <sys/abi_compat.h>
@@ -46,6 +47,7 @@
 #include <sys/capsicum.h>
 #include <sys/disk.h>
 #include <sys/dirent.h>
+#include <sys/exterrvar.h>
 #include <sys/fcntl.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
@@ -982,8 +984,14 @@ kern_chroot(struct thread *td, struct vnode *vp)
        error = priv_check(td, PRIV_VFS_CHROOT);
        if (error != 0) {
                p = td->td_proc;
-               if (unprivileged_chroot == 0 ||
-                   (p->p_flag2 & P2_NO_NEW_PRIVS) == 0) {
+               if (unprivileged_chroot == 0) {
+                       error = EXTERROR(EPERM,
+                   "security.bsd.unprivileged_chroot sysctl not enabled");
+                       goto e_vunlock;
+               }
+               if ((p->p_flag2 & P2_NO_NEW_PRIVS) == 0) {
+                       error = EXTERROR(EPERM,
+                           "PROC_NO_NEW_PRIVS not enabled");
                        goto e_vunlock;
                }
        }
diff --git a/sys/sys/exterr_cat.h b/sys/sys/exterr_cat.h
index 80cff53b3576..43f31e1d5dd6 100644
--- a/sys/sys/exterr_cat.h
+++ b/sys/sys/exterr_cat.h
@@ -20,6 +20,7 @@
 #define        EXTERR_CAT_GENIO        6
 #define        EXTERR_CAT_BRIDGE       7
 #define        EXTERR_CAT_SWAP         8
+#define        EXTERR_CAT_VFSSYSCALL   9
 
 #endif