Re: kern/60737 (At securelevel 2, root can still set the clock backwards, contrary to what securelevel(9) states)

[riastradh%NetBSD.org@localhost]

Synopsis: At securelevel 2, root can still set the clock backwards, contrary to what securelevel(9) states

State-Changed-From-To: open->analyzed
State-Changed-By: riastradh%NetBSD.org@localhost
State-Changed-When: Thu, 17 Sep 2026 01:58:44 +0000
State-Changed-Why:
This is inadvertently allowed by the /dev/clockctl path, which is meant
to allow adjusting the clock even if uid != 0 -- but also allows clock
shenanigans even if securelevel > 1.

The reason this happens is that the two checks are combined into one
kauth(9) query, and in an attempt to bypass the uid != 0 check for
clockctl, the logic also bypasses the securelevel > 1 check:

    226 	if (check_kauth && kauth_authorize_system(kauth_cred_get(),
    227 	    KAUTH_SYSTEM_TIME, KAUTH_REQ_SYSTEM_TIME_SYSTEM, __UNCONST(ts),
    228 	    &delta, KAUTH_ARG(check_kauth ? false : true)) != 0) {
    229 		return SET_ERROR(EPERM);

https://nxr.NetBSD.org/xref/src/sys/kern/kern_time.c?r=1.232#226

Why the KAUTH_ARG(check_kauth ? false : true) argument is passed
through here is unclear to me; in context, check_kauth is _always_ true
at that point, and...none of the secmodels use the parameter anyway.
Perhaps the intent was to use a single query to check one or two things
(1. are we allowed to change the time at all? 2. are we allowed to
change it backwards?) but that's not what was actually done.

This was probably broken back in 2007p:

https://mail-index.netbsd.org/source-changes/2007/11/25/msg193466.html

Module Name:    src
Committed By:   elad
Date:           Sun Nov 25 00:35:28 UTC 2007

Modified Files:
        src/share/man/man9: kauth.9
        src/sys/compat/hpux: hpux_compat.c
        src/sys/compat/linux/common: linux_misc_notalpha.c linux_time.c
        src/sys/compat/linux32/common: linux32_time.c
        src/sys/compat/netbsd32: netbsd32_time.c
        src/sys/dev: clockctl.c
        src/sys/kern: kern_time.c
        src/sys/secmodel/bsd44: secmodel_bsd44_suser.c
        src/sys/secmodel/securelevel: secmodel_securelevel.c
        src/sys/sys: timevar.h

Log Message:
Refactor time modification checks and place them in the secmodel code.

okay christos@


To generate a diff of this commit:
cvs rdiff -r1.55 -r1.56 src/share/man/man9/kauth.9
cvs rdiff -r1.97 -r1.98 src/sys/compat/hpux/hpux_compat.c
cvs rdiff -r1.96 -r1.97 src/sys/compat/linux/common/linux_misc_notalpha.c
cvs rdiff -r1.19 -r1.20 src/sys/compat/linux/common/linux_time.c
cvs rdiff -r1.13 -r1.14 src/sys/compat/linux32/common/linux32_time.c
cvs rdiff -r1.27 -r1.28 src/sys/compat/netbsd32/netbsd32_time.c
cvs rdiff -r1.22 -r1.23 src/sys/dev/clockctl.c
cvs rdiff -r1.131 -r1.132 src/sys/kern/kern_time.c
cvs rdiff -r1.39 -r1.40 src/sys/secmodel/bsd44/secmodel_bsd44_suser.c
cvs rdiff -r1.2 -r1.3 src/sys/secmodel/securelevel/secmodel_securelevel.c
cvs rdiff -r1.17 -r1.18 src/sys/sys/timevar.h