git: feb193187bf0 - stable/15 - sysctl: Return ECAPMODE when trying to access sysctls in capability mode

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=feb193187bf059a3d9498d383b719544d6c42de0

commit feb193187bf059a3d9498d383b719544d6c42de0
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-09-28 21:59:40 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-22 15:45:41 +0000

    sysctl: Return ECAPMODE when trying to access sysctls in capability mode
    
    We have always returned EPERM in this case, but it's incorrect, we
    should return ECAPMODE for capability mode violations.  Fix the errno
    value.
    
    Reviewed by:    emaste
    MFC after:      2 weeks
    Differential Revision:  https://reviews.freebsd.org/D59887
    
    (cherry picked from commit a76e986470f86731dd3a5f9eeae1ba28b8b160fb)
---
 lib/libc/gen/sysctl.3  | 3 +++
 sys/kern/kern_sysctl.c | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/libc/gen/sysctl.3 b/lib/libc/gen/sysctl.3
index ef897c653728..6b87ec8bbd1b 100644
--- a/lib/libc/gen/sysctl.3
+++ b/lib/libc/gen/sysctl.3
@@ -950,6 +950,9 @@ array specifies a value that is unknown.
 An attempt is made to set a read-only value.
 .It Bq Er EPERM
 A process without appropriate privilege attempts to set a value.
+.It Bq Er ECAPMODE
+The process is in capability mode and the variable is not accessible
+in capability mode.
 .El
 .Sh SEE ALSO
 .Xr confstr 3 ,
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index 51a6530ee522..b5449af5d32e 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -2370,7 +2370,7 @@ sysctl_root(SYSCTL_HANDLER_ARGS)
 	if (IN_CAPABILITY_MODE(req->td)) {
 		if ((req->oldptr && !(oid->oid_kind & CTLFLAG_CAPRD)) ||
 		    (req->newptr && !(oid->oid_kind & CTLFLAG_CAPWR))) {
-			error = EPERM;
+			error = ECAPMODE;
 			goto out;
 		}
 	}