From nobody Fri Aug 28 12:05:15 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hWcXD3xZDz6qHRl for ; Fri, 28 Aug 2026 12:05:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hWcXC6Vbbz3C0S for ; Fri, 28 Aug 2026 12:05:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787918716; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yXypP8JZTs4HNuQwd80K65Dav+CQzE2Oy9hPL6NLW9E=; b=NqWlk8u9svsLu1tDa3lRPiXHhJfVnCmosxuehTTBrozf7g77gTtDhMkm+FKiAr9Vadu43T ooYfmcgYlAcFJYHietmC/j1XGQJcqj2Qe0v0SZDyw2PfCfqZ4kg4hfxJfNmESBndBkawuH MS317ktzyEnpk5UKU1JlOMkAZOPHS0QWmjddxVYHMRdDWiyTUFflCtVKCe9xz8QrYPIW3z em6sO+IbqQ5MRVQVy3TG5HcSSgdW7l7SHVAB8xu8p1cdkvHAi3VBN1WYyXkmKno7je3QBV wtvpg0zHNKqSiQaqWNqV5AVTRqsRXLchaZIoQOXqjNTl3ZoDhRLV943k89zmGg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787918716; a=rsa-sha256; cv=none; b=kw8UOkfzbexoIRpg/wuNRJmcX/2rOt96zAaIJAeq1akYl5U6j2mQJXYg12MO0b6XBVrA6l O43sE6OAwTaIkIbSvDCpAKhwEaPh9aSu5vSdQclcBJsA9A69++JEJ+FUr1/CzyH0zTfodw ZzdD/vuQ4KJlj67pEn86SunRF4+8sypcSZYZLatKwjeGy7QlKsrSAoCjFNbSPK0z/YS3ob 8Objeyb88+1tL1OY5vxmpLZ4hzUaZmNOJAOkdK5ZuxtLWMZ5Z4VDVgKdZvh8H63r84O9Y3 cr4BH+OEJRAZ5qVtUNm130htS5NOCPDG4SKe8vy+6hkUkJo9znQkI88GsVJkyQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787918716; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yXypP8JZTs4HNuQwd80K65Dav+CQzE2Oy9hPL6NLW9E=; b=MlARXyhrSd0ABmE2WKvNQTS4xpSfUoD9oWAegnAeAzJeKH1cSqJfCJ+VDwWuiM9bWMr7hR QRgRRYB1fgwK6vOwpG6pZofGhmB9hRJF05MgBAbzvSHdgIOA5Sj6lwDxRdaKAFO0KYbFHS 1S1Kk5piO6pdp06YE3IXHinGlUDiKApRWxsw6HczHCfGXRf7vjkLN+h+Z7DXMFMEB2Eoer arJWs+Mw7bqbYJLccbgS8RtC3Kz3fSrW8w3J/sygCy1hgNthOXJEzqhK4ZPvcF9mcPIXja YMWD/OHd/i/o1KtUtPHONFCuwFhQycelpXo+XcOowpb8MbmDnHjbUUM2r6TSeA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hWcXC5YQKz18Lt for ; Fri, 28 Aug 2026 12:05:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 25044 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 28 Aug 2026 12:05:15 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: 68d4b311270e - main - kern: add p_canopen() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 68d4b311270ecca80bbb887a5e502e2caacebc98 Auto-Submitted: auto-generated Date: Fri, 28 Aug 2026 12:05:15 +0000 Message-Id: <6a91797b.25044.6b5715f5@gitrepo.freebsd.org> The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=68d4b311270ecca80bbb887a5e502e2caacebc98 commit 68d4b311270ecca80bbb887a5e502e2caacebc98 Author: Konstantin Belousov AuthorDate: 2026-07-14 16:59:17 +0000 Commit: Konstantin Belousov CommitDate: 2026-08-28 11:55:10 +0000 kern: add p_canopen() The function defines the policy for allowing to open a pid. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58989 --- sys/kern/kern_prot.c | 28 ++++++++++++++++++++++++++-- sys/kern/sys_process.c | 5 +++++ sys/sys/proc.h | 1 + sys/sys/ptrace.h | 1 + 4 files changed, 33 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index 5aa7fcf7c653..5370028f4490 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -46,14 +46,13 @@ * System calls related to processes and protection */ -#include #include "opt_inet.h" #include "opt_inet6.h" -#include #include #include #include +#include #include #include #include @@ -2313,6 +2312,31 @@ cr_xids_subset(struct ucred *active_cred, struct ucred *obj_cred) return (uidsubset && grpsubset); } +/* + * Determine whether the td thread allowed to do pdopenpid(2) on the + * process p. The permissions are scoped to the PIDs namespace and + * processes hierarchy, and do not imply permissions to perform + * operations on the resulting process descriptor, e.g. pdkill(2) and + * other. + */ +int +p_canopen(struct thread *td, struct proc *p) +{ +#ifdef INVARIANTS + if (IN_CAPABILITY_MODE(td)) + sx_assert(&proctree_lock, SX_LOCKED); +#endif + + /* + * Allow implicit parent in cap mode: either real parent or + * debugger can open pid. + */ + if (!IN_CAPABILITY_MODE(td) || (allow_ptrace_in_cap_mode && + (td->td_proc == p->p_pptr || p->p_oppid == td->td_proc->p_pid))) + return (0); + return (ECAPMODE); +} + /*- * Determine whether td may debug p. * Returns: 0 for permitted, an errno value otherwise diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c index 2cf9ffaa68dd..35aa376fb6f5 100644 --- a/sys/kern/sys_process.c +++ b/sys/kern/sys_process.c @@ -70,6 +70,11 @@ #include #endif +bool allow_ptrace_in_cap_mode = true; +SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace_in_cap_mode, CTLFLAG_RWTUN, + &allow_ptrace_in_cap_mode, 0, + "Allow ptrace(2) in capability mode"); + /* Assert it's safe to unlock a process, e.g. to allocate working memory */ #define PROC_ASSERT_TRACEREQ(p) MPASS(((p)->p_flag2 & P2_PTRACEREQ) != 0) diff --git a/sys/sys/proc.h b/sys/sys/proc.h index c052540cece5..a10bcfb9d910 100644 --- a/sys/sys/proc.h +++ b/sys/sys/proc.h @@ -1195,6 +1195,7 @@ int leavepgrp(struct proc *p); void maybe_yield(void); void mi_switch(int flags); int p_candebug(struct thread *td, struct proc *p); +int p_canopen(struct thread *td, struct proc *p); int p_cansee(struct thread *td, struct proc *p); int p_cansched(struct thread *td, struct proc *p); int p_cansignal(struct thread *td, struct proc *p, int signum); diff --git a/sys/sys/ptrace.h b/sys/sys/ptrace.h index 1e219b606dbd..d6e071285eac 100644 --- a/sys/sys/ptrace.h +++ b/sys/sys/ptrace.h @@ -296,6 +296,7 @@ int ptrace_action(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd, lwpid_t lwpid, void *addr, int data); extern bool allow_ptrace; +extern bool allow_ptrace_in_cap_mode; #else /* !_KERNEL */