chflags: use Capsicum capability mode

Run the file-hierarchy traversal inside Capsicum capability mode
using the fts_openat(3) API. This confines chflags to the directory
hierarchies named on the c

chflags: use Capsicum capability mode

Run the file-hierarchy traversal inside Capsicum capability mode
using the fts_openat(3) API. This confines chflags to the directory
hierarchies named on the command line, so a malicious or buggy tree
cannot redirect it at files elsewhere via a crafted symbolic link.

Because AT_FDCWD is rejected in capability mode, a directory descriptor
for the parent directory of every argument with an absolute path or a
path containing ".." is opened once before cap_enter(). Once every
descriptor is open, cap_enter() is called and the traversal acts through
fd-relative operations: chflagsat(fts_parent->fts_dirfd, fts_name).

With -L chflags follows symbolic links, which may point outside the
named hierarchy; chflag now rejects such accesses. The new
--dereference-links-unsafely option disables the sandbox to restore the
historical behavior for the rare callers that rely on it. But if the
symbolic was link was named directly on the command line, chflags will
still follow it (unless -h was given).

Add functional tests covering relative, absolute, "..", recursive
and mixed path arguments, and the symlink handling in both the
default and --dereference-links-unsafely modes; they skip on
filesystems that do not support the uchg flag.

Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Relnotes: yes (for the -L behavior change)
Pull Request: https://github.com/freebsd/freebsd-src/pull/2375

show more ...