git: 72e34b3e3907 - main - get/setpriority: Add capability mode checks

The branch main has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=72e34b3e3907d5fd63abf7b2246cae80641769b3

commit 72e34b3e3907d5fd63abf7b2246cae80641769b3
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2026-05-29 20:48:34 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2026-06-01 16:30:20 +0000

    get/setpriority: Add capability mode checks
    
    Reviewed by: oshogbo
    Sponsored by: The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D57345
---
 sys/kern/kern_resource.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
index 31f89bd41f6d..95c4e7d5eead 100644
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -37,6 +37,7 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
+#include <sys/capsicum.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
 #include <sys/kernel.h>
@@ -99,6 +100,13 @@ kern_getpriority(struct thread *td, int which, int who)
 	struct pgrp *pg;
 	int error, low;
 
+	if (IN_CAPABILITY_MODE(td)) {
+		if (which != PRIO_PROCESS)
+			return (ECAPMODE);
+		if (who != 0 && who != td->td_proc->p_pid)
+			return (ECAPMODE);
+	}
+
 	error = 0;
 	low = PRIO_MAX + 1;
 	switch (which) {
@@ -189,6 +197,14 @@ kern_setpriority(struct thread *td, int which, int who, int prio)
 	int found = 0, error = 0;
 
 	curp = td->td_proc;
+
+	if (IN_CAPABILITY_MODE(td)) {
+		if (which != PRIO_PROCESS)
+			return (ECAPMODE);
+		if (who != 0 && who != curp->p_pid)
+			return (ECAPMODE);
+	}
+
 	switch (which) {
 	case PRIO_PROCESS:
 		if (who == 0) {