From nobody Sat Sep 05 00:35:29 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hcDrd4qCDz6qZQD for ; Sat, 05 Sep 2026 00:35:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hcDrd2cjtz44FZ for ; Sat, 05 Sep 2026 00:35:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788568529; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C1Idl9otH+u60grEs6uOrl+dQt+VX3l2x8773PCXGxQ=; b=ZO8FLbQs1ZN/htsbieXseb/nGVU1ej/qZl5L3nJauLjw/o67adFbCw3kdGmUmUAX4FxGsZ tcuIESebwDBMCpDKxXndKp0L6MDUzY63YNMOhxreBFXyIDu+G/vWBA9/fCvAzof0IQuNQ5 Kz2FLVzboGNAO6z0WFQbyHFyWe59YmwsLvi00dIwPPMa0tJBAmEK1pt9ZF0I25hsKBm/iP Fv+lIA/KySUIc3VNheda3XGIqobPDMorMgic4YNarUwqecQ/4HWcQ65Bn+lizJeRZW0uf1 9ORZaAueUJB3/AzoV21sR5MnuTwFR/E/96R0nwwQ3FZ+FFN265iw+HLXCtMcRA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788568529; a=rsa-sha256; cv=none; b=bU1mzBYmSl7BlwskAN6dUB49rFrmuGHXNY6Nz5cDr6d3dxSjMWw1W6pl4QWCG/34MmYB4Y 5GeVjwexmzJn68UrgVBVH6Rk6MsGUOsHChbpiIdKKuqXy6ultf8AcJQX5k4ZRHLYAk+dPy ZQLSHMwgL1Db+c54Orrnswa4V/7iVJD9VqKZ1QdoEGWl8TvAkUweZCKWp4jUeVZzay2sRQ MfCfv8FD/QLFmwAEM+AWHF0dlgKLUBgK7DfTEuM4V7TRoJbWp6LWzIxWVS9q+cyyPbw4rV slsKP5/Kz7R4hN5IibU5fK34drC8JKKRRYvpwrK6GGmsq5fEkGSrK16rzHmxIQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788568529; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C1Idl9otH+u60grEs6uOrl+dQt+VX3l2x8773PCXGxQ=; b=n2DL7DwVwyJgzfCv8ZbQL/kXOhXgG5NDKxl65E7ySmg+7xcUNMGF6bgeJ57ys8g1yG0N/8 lebJk4qr5Yriqfdo8A471mJoVUi+co1i0EBgW5AT0aOI3LcjMvblrXeoqVv7w0Yv0YOlC4 Stz7oX0yH8s74j8swsLuing0OnY0dc/8Atc3LugTg54TuKjjRbE36s/A2AkEk63JMtav1r dGbkmYB7QwG5ZHwSQcpzf1QTqGbG7dEDMfod2NJwsXRcH6UPf45NQBNlwfTE+kaSvxhTYd zAIOm8nHFopTVWPvjwu/99dsd4dne8o59ZpZtLTBTuloF1/FxjmVUPXshIooWQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hcDrd0xTWz7vV for ; Sat, 05 Sep 2026 00:35:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 20406 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 05 Sep 2026 00:35:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: 5e9d42f6aa71 - stable/15 - kern: add p_canopen() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 5e9d42f6aa710d71d1c054fa34e984d37447a850 Auto-Submitted: auto-generated Date: Sat, 05 Sep 2026 00:35:29 +0000 Message-Id: <6a9b63d1.20406.31f52cb8@gitrepo.freebsd.org> The branch stable/15 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=5e9d42f6aa710d71d1c054fa34e984d37447a850 commit 5e9d42f6aa710d71d1c054fa34e984d37447a850 Author: Konstantin Belousov AuthorDate: 2026-07-14 16:59:17 +0000 Commit: Konstantin Belousov CommitDate: 2026-09-05 00:33:41 +0000 kern: add p_canopen() (cherry picked from commit 68d4b311270ecca80bbb887a5e502e2caacebc98) --- sys/kern/kern_prot.c | 28 ++++++++++++++++++++++++++-- sys/kern/sys_process.c | 5 +++++ sys/sys/proc.h | 1 + sys/sys/ptrace.h | 1 + 4 files changed, 33 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index 5aa7fcf7c653..5370028f4490 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -46,14 +46,13 @@ * System calls related to processes and protection */ -#include #include "opt_inet.h" #include "opt_inet6.h" -#include #include #include #include +#include #include #include #include @@ -2313,6 +2312,31 @@ cr_xids_subset(struct ucred *active_cred, struct ucred *obj_cred) return (uidsubset && grpsubset); } +/* + * Determine whether the td thread allowed to do pdopenpid(2) on the + * process p. The permissions are scoped to the PIDs namespace and + * processes hierarchy, and do not imply permissions to perform + * operations on the resulting process descriptor, e.g. pdkill(2) and + * other. + */ +int +p_canopen(struct thread *td, struct proc *p) +{ +#ifdef INVARIANTS + if (IN_CAPABILITY_MODE(td)) + sx_assert(&proctree_lock, SX_LOCKED); +#endif + + /* + * Allow implicit parent in cap mode: either real parent or + * debugger can open pid. + */ + if (!IN_CAPABILITY_MODE(td) || (allow_ptrace_in_cap_mode && + (td->td_proc == p->p_pptr || p->p_oppid == td->td_proc->p_pid))) + return (0); + return (ECAPMODE); +} + /*- * Determine whether td may debug p. * Returns: 0 for permitted, an errno value otherwise diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c index 0752e84e7c4e..1bfa0f04959d 100644 --- a/sys/kern/sys_process.c +++ b/sys/kern/sys_process.c @@ -70,6 +70,11 @@ #include #endif +bool allow_ptrace_in_cap_mode = true; +SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace_in_cap_mode, CTLFLAG_RWTUN, + &allow_ptrace_in_cap_mode, 0, + "Allow ptrace(2) in capability mode"); + /* Assert it's safe to unlock a process, e.g. to allocate working memory */ #define PROC_ASSERT_TRACEREQ(p) MPASS(((p)->p_flag2 & P2_PTRACEREQ) != 0) diff --git a/sys/sys/proc.h b/sys/sys/proc.h index 3082ffacb726..89a1d791609d 100644 --- a/sys/sys/proc.h +++ b/sys/sys/proc.h @@ -1195,6 +1195,7 @@ int leavepgrp(struct proc *p); void maybe_yield(void); void mi_switch(int flags); int p_candebug(struct thread *td, struct proc *p); +int p_canopen(struct thread *td, struct proc *p); int p_cansee(struct thread *td, struct proc *p); int p_cansched(struct thread *td, struct proc *p); int p_cansignal(struct thread *td, struct proc *p, int signum); diff --git a/sys/sys/ptrace.h b/sys/sys/ptrace.h index 942af4eba51f..aeabd1961c21 100644 --- a/sys/sys/ptrace.h +++ b/sys/sys/ptrace.h @@ -296,6 +296,7 @@ int ptrace_action(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd, lwpid_t lwpid, void *addr, int data); extern bool allow_ptrace; +extern bool allow_ptrace_in_cap_mode; #else /* !_KERNEL */