kern/60737: At securelevel 2, root can still set the clock backwards, contrary to what securelevel(9) states

["david%gutteridge.ca@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60737
>Category:       kern
>Synopsis:       At securelevel 2, root can still set the clock backwards, contrary to what securelevel(9) states
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 17 01:20:00 +0000 2026
>Originator:     David H. Gutteridge
>Release:        HEAD
>Organization:
TNF
>Environment:
NetBSD arm64 11.99.8 NetBSD 11.99.8 (GENERIC64) #0: Mon Sep  7 08:02:15 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/evbarm/compile/GENERIC64 evbarm
>Description:
Simply put, securelevel(9) states that under securelevel 2 "The system
clock may not be set backwards or close to overflow." I read this to
mean just that, that one then cannot use date(1) or any other utility
to set the time backwards.

Evidently this is not true, e.g.,

arm64$ uname -a
NetBSD arm64 11.99.8 NetBSD 11.99.8 (GENERIC64) #0: Mon Sep  7 08:02:15 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/evbarm/compile/GENERIC64 evbarm
arm64$ sysctl -a | grep securelevel
kern.securelevel = 2
security.models.bsd44.securelevel = 2
security.models.securelevel.name = Traditional NetBSD: Securelevel
security.models.securelevel.securelevel = 2
[...]
arm64# date
Wed Sep 16 16:47:35 UTC 2026
arm64# date 1532.00
Wed Sep 16 15:32:00 UTC 2026
arm64# date
Wed Sep 16 15:32:02 UTC 2026
arm64# rdate -4 time.nist.gov
Wed Sep 16 16:48:06 2026
arm64# date
Wed Sep 16 16:48:07 UTC 2026

Either the intended implementation is broken, or the documentation needs
more detail to explain just what is meant. (I'm guessing it's broken.
I haven't looked at the code, yet. I gather we don't have test cases
for expected behavioural differences at different securelevel settings,
too.)

>How-To-Repeat:
As above.
>Fix:
Not analyzed.