Index: sys/kern/kern_pledge.c =================================================================== RCS file: /cvs/src/sys/kern/kern_pledge.c,v diff -u -p -r1.369 kern_pledge.c --- sys/kern/kern_pledge.c 21 Sep 2026 00:46:13 -0000 1.369 +++ sys/kern/kern_pledge.c 20 Oct 2026 13:28:26 -0000 @@ -395,9 +395,11 @@ static const struct { { "prot_exec", PLEDGE_PROTEXEC }, { "ps", PLEDGE_PS }, { "recvfd", PLEDGE_RECVFD }, +// { "recvpubdevfd", PLEDGE_RECVPUBDEVFD }, { "route", PLEDGE_ROUTE }, { "rpath", PLEDGE_RPATH }, { "sendfd", PLEDGE_SENDFD }, +// { "sendpubdevfd", PLEDGE_SENDPUBDEVFD }, { "settime", PLEDGE_SETTIME }, { "stdio", PLEDGE_STDIO }, { "tape", PLEDGE_TAPE }, Index: sys/kern/uipc_usrreq.c =================================================================== RCS file: /cvs/src/sys/kern/uipc_usrreq.c,v diff -u -p -r1.224 uipc_usrreq.c --- sys/kern/uipc_usrreq.c 19 Sep 2026 17:21:52 -0000 1.224 +++ sys/kern/uipc_usrreq.c 20 Oct 2026 13:28:26 -0000 @@ -1085,7 +1085,8 @@ unp_externalize(struct mbuf *rights, soc * No to block devices. If passing a directory, * make sure that it is underneath the root. */ - if (fdp->fd_rdir != NULL && fp->f_type == DTYPE_VNODE) { + /* it s pledge job to pledge ress */ + /* if (fdp->fd_rdir != NULL && fp->f_type == DTYPE_VNODE) { struct vnode *vp = (struct vnode *)fp->f_data; if (vp->v_type == VBLK || @@ -1095,6 +1096,7 @@ unp_externalize(struct mbuf *rights, soc break; } } + */ } KERNEL_UNLOCK(); Index: usr.sbin/vmd/config.c =================================================================== RCS file: /cvs/src/usr.sbin/vmd/config.c,v diff -u -p -r1.84 config.c --- usr.sbin/vmd/config.c 30 Aug 2026 23:23:18 -0000 1.84 +++ usr.sbin/vmd/config.c 20 Oct 2026 13:28:27 -0000 @@ -340,6 +340,7 @@ config_setvm(struct privsep *ps, struct ret = VMD_DISK_MISSING; goto fail; } + /* NOTE so this fd is send over IMSG , and /dev/vnd0c cant be ... pledge stuff */ /* * Check if it's a regular file and accessible to Index: usr.sbin/vmd/control.c =================================================================== RCS file: /cvs/src/usr.sbin/vmd/control.c,v diff -u -p -r1.55 control.c --- usr.sbin/vmd/control.c 29 Jul 2026 13:32:18 -0000 1.55 +++ usr.sbin/vmd/control.c 20 Oct 2026 13:28:27 -0000 @@ -72,7 +72,8 @@ control_run(struct privsep *ps, struct p * recvfd - for the proc fd exchange. * sendfd - for send and receive. */ - if (pledge("stdio unix recvfd sendfd", NULL) == -1) + log_debug( "%s: pledge stdio unix recvfd sendfd disklabel ", __func__); + if (pledge("stdio unix recvfd sendfd disklabel", NULL) == -1) fatal("pledge"); /* Signal to the parent that we're done initializing. */ Index: usr.sbin/vmd/proc.c =================================================================== RCS file: /cvs/src/usr.sbin/vmd/proc.c,v diff -u -p -r1.40 proc.c --- usr.sbin/vmd/proc.c 8 Sep 2026 19:46:18 -0000 1.40 +++ usr.sbin/vmd/proc.c 20 Oct 2026 13:28:27 -0000 @@ -445,8 +445,10 @@ proc_dispatch(int fd, short event, void ibuf = &iev->ibuf; if (event & EV_READ) { - if ((n = imsgbuf_read(ibuf)) == -1) + n = imsgbuf_read(ibuf); + if (n == -1) { fatal("%s: imsgbuf_read", __func__); + } if (n == 0) { /* this pipe is dead, so remove the event handler */ event_del(&iev->ev); Index: usr.sbin/vmd/vioblk.c =================================================================== RCS file: /cvs/src/usr.sbin/vmd/vioblk.c,v diff -u -p -r1.37 vioblk.c --- usr.sbin/vmd/vioblk.c 7 Oct 2026 23:06:26 -0000 1.37 +++ usr.sbin/vmd/vioblk.c 20 Oct 2026 13:28:27 -0000 @@ -76,7 +76,8 @@ vioblk_main(int fd, int vm_fd) * stdio - needed for read/write to disk fds and channels to the vm. * vmm + proc - needed to create shared vm mappings. */ - if (pledge("stdio vmm proc", NULL) == -1) + log_debug("%s: PLdge vioblk_main stdio vmm proc disklabel", __func__); + if (pledge("stdio vmm proc disklabel", NULL) == -1) fatal("pledge"); /* Zero and initialize io work queue. */ @@ -127,7 +128,7 @@ vioblk_main(int fd, int vm_fd) * We no longer need VM fd access. */ close_fd(vm_fd); - if (pledge("stdio", NULL) == -1) + if (pledge("stdio disklabel", NULL) == -1) fatal("pledge2"); /* Initialize the virtio block abstractions. */ Index: usr.sbin/vmd/vioraw.c =================================================================== RCS file: /cvs/src/usr.sbin/vmd/vioraw.c,v diff -u -p -r1.11 vioraw.c --- usr.sbin/vmd/vioraw.c 14 Sep 2023 15:25:43 -0000 1.11 +++ usr.sbin/vmd/vioraw.c 20 Oct 2026 13:28:27 -0000 @@ -17,13 +17,22 @@ #include #include +#include +#include +#include +#include +#include #include +#include +#include +#include #include #include #include #include "virtio.h" +#include "proc.h" static ssize_t raw_pread(void *file, char *buf, size_t len, off_t off) @@ -57,6 +66,59 @@ raw_close(void *file, int stayopen) free(file); } + +// very ugly code to extract some sort of diskspace size without talking driver +// ai generated +// Returns total size in bytes, or -1 on failure +static off_t get_savage_disk_size(int fd) { + char sector[512]; + + // Read sector 0 + if (pread(fd, sector, sizeof(sector), 0) != sizeof(sector)) + return -1; + + // Check for MBR boot signature at the end of sector 0 (0x55AA) + uint16_t mbr_sig = *(uint16_t *)(sector + 0x1FE); + if (mbr_sig == 0xAA55) { + // Look through the 4 MBR partition entries (starting at 0x1BE) + // We want to find an OpenBSD partition (type 0xA6) or just grab the last active one/largest. + // For our savage assumption, let's parse the specific offsets you mapped: + // Entry 3 starts at 0x1EE (or loop through them). Let's check entry 3 (offset 0x1EE). + + unsigned char *entry = (unsigned char *)(sector + 0x1EE); + uint8_t type = entry[4]; // Partition type + + if (type == 0xA6) { // OpenBSD type + uint32_t start_lba = *(uint32_t *)(entry + 8); + uint32_t size_sectors = *(uint32_t *)(entry + 12); + + // Total capacity spanned by this partition slice on disk + return (off_t)(start_lba + size_sectors) * 512; + } + + // If entry 3 isn't OpenBSD, loop through all 4 entries to find any 0xA6 + for (int i = 0; i < 4; i++) { + unsigned char *e = (unsigned char *)(sector + 0x1BE + (i * 16)); + if (e[4] == 0xA6) { + uint32_t start_lba = *(uint32_t *)(e + 8); + uint32_t size_sectors = *(uint32_t *)(e + 12); + return (off_t)(start_lba + size_sectors) * 512; + } + } + } + + // Fallback: Check if it's a raw FFS filesystem directly on the device + char sb_buf[SBSIZE]; + if (pread(fd, sb_buf, sizeof(struct fs), 8192) == sizeof(struct fs)) { + struct fs *fs = (struct fs *)sb_buf; + if (fs->fs_magic == FS_MAGIC || fs->fs_magic == FS_UFS2_MAGIC) { + return (off_t)fs->fs_size * fs->fs_fsize; + } + } + + return -1; // Unknown layout +} + /* * Initializes a raw disk image backing file from an fd. Stores the * number of bytes in *szp, returning -1 for error, 0 for success. @@ -66,13 +128,46 @@ virtio_raw_init(struct virtio_backing *f { off_t sz; int *fdp; + struct stat st; + struct disklabel dl; + int part; + log_debug("%s: WUIUUT ioctl on %d", __func__, fd[0]); if (nfd != 1) return (-1); - sz = lseek(fd[0], 0, SEEK_END); - if (sz == -1) + if (fstat(fd[0], &st) == -1) return (-1); + +log_debug("%s: fstat mode = %o | is_chr = %d | is_blk = %d | rdev = %lx", + __func__, st.st_mode, S_ISCHR(st.st_mode), S_ISBLK(st.st_mode), (unsigned long)st.st_rdev); +log_debug("%s: uid=%d, euid=%d", __func__, getuid(), geteuid()); + + // this wont work, DIOCGDINFO is suser only , why ? i do not know, chown /dev/vndX? is ignored for that part, feels like some guardrail against nuking yourself, but + // i do not see the purpose + if (ioctl(fd[0], DIOCGDINFO, &dl) != -1) { + log_debug("%s: ioctl ok ", __func__); + part = DISKPART(st.st_rdev); + log_debug("%s: %d fd, part %d", __func__, fd[0], part ); + if (part >= dl.d_npartitions || dl.d_secsize == 0) + return (-1); + if ((uintmax_t)dl.d_partitions[part].p_size > + (uintmax_t)INT64_MAX / dl.d_secsize) + return (-1); + log_debug("%s: %d fd, part %d , sec %d p_size %d", __func__, fd[0], part, dl.d_secsize, dl.d_partitions[part].p_size ); + sz = (off_t)dl.d_partitions[part].p_size * dl.d_secsize; + } else { + log_debug("%s: ioctl NOK %d, errno = %d (%s)", __func__, fd[0], errno, strerror(errno)); + log_debug("%s: ioctl NOK %d ", __func__, fd[0]); + sz = lseek(fd[0], 0, SEEK_END); + } + if (sz <= 0) { + // lets do a bit of stick in the wheel + log_debug("%s: just a bit silly Mkayyyyy %d ", __func__, fd[0]); + sz = get_savage_disk_size(fd[0]); + if (sz <= 0) + return (-1); + } fdp = malloc(sizeof(int)); if (!fdp) Index: usr.sbin/vmd/vm.c =================================================================== RCS file: /cvs/src/usr.sbin/vmd/vm.c,v diff -u -p -r1.135 vm.c --- usr.sbin/vmd/vm.c 19 Sep 2026 17:21:52 -0000 1.135 +++ usr.sbin/vmd/vm.c 20 Oct 2026 13:28:27 -0000 @@ -142,7 +142,8 @@ vm_main(int fd, int fd_vmm) * vmm - for the vmm ioctls and operations. * proc exec - fork/exec for launching devices. */ - if (pledge("stdio vmm proc exec", NULL) == -1) + log_debug("PLEDGING stdio vmm proc exec disklabel"); + if (pledge("stdio vmm proc exec disklabel", NULL) == -1) fatal("pledge"); /* Receive our vm configuration. */ @@ -306,7 +307,8 @@ start_vm(struct vmd_vm *vm, int fd) } /* Drop privileges further before starting the vcpu run loop(s). */ - if (pledge("stdio vmm", NULL) == -1) + log_debug("PLEDGING stdio vmm disklabel"); + if (pledge("stdio vmm disklabel", NULL) == -1) fatal("pledge"); /* Index: usr.sbin/vmd/vmd.c =================================================================== RCS file: /cvs/src/usr.sbin/vmd/vmd.c,v diff -u -p -r1.186 vmd.c --- usr.sbin/vmd/vmd.c 5 Oct 2026 23:07:37 -0000 1.186 +++ usr.sbin/vmd/vmd.c 20 Oct 2026 13:28:27 -0000 @@ -813,7 +813,8 @@ vmd_configure(void) * chown, fattr - change tty ownership * flock - locking disk files */ - if (pledge("stdio rpath wpath proc tty recvfd sendfd getpw" + log_debug( "%s: plesdge stdio rpath wpath proc tty recvfd sendfd getpw disklabel", __func__); + if (pledge("stdio rpath wpath proc tty recvfd sendfd getpw disklabel" " chown fattr flock", NULL) == -1) fatal("pledge"); @@ -1559,8 +1560,12 @@ vm_checkaccess(int fd, unsigned int ufla /* * File has to be accessible and a regular file */ - if (fstat(fd, &st) == -1 || !S_ISREG(st.st_mode)) + if (fstat(fd, &st) == -1) return (-1); + if (!S_ISREG(st.st_mode)) { + if (!S_ISBLK(st.st_mode) || major(st.st_rdev) != 14) + return (-1); + } /* root has no restrictions */ if (uid == 0 || uflag == 0) Index: usr.sbin/vmd/vmm.c =================================================================== RCS file: /cvs/src/usr.sbin/vmd/vmm.c,v diff -u -p -r1.143 vmm.c --- usr.sbin/vmd/vmm.c 19 Sep 2026 17:21:52 -0000 1.143 +++ usr.sbin/vmd/vmm.c 20 Oct 2026 13:28:27 -0000 @@ -97,7 +97,7 @@ vmm_run(struct privsep *ps, struct privs * sendfd - for sending send/recv fds to vm proc. * recvfd - for disks, interfaces and other fds. */ - if (pledge("stdio vmm sendfd recvfd proc exec ps", NULL) == -1) + if (pledge("stdio vmm sendfd recvfd proc exec ps disklabel", NULL) == -1) fatal("pledge"); signal_del(&ps->ps_evsigchld);