git: 1cab7e212476 - stable/15 - pdptrace(2): allow debugging in capability mode

The branch stable/15 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=1cab7e212476174fc749627cc5114ebaf3f92590

commit 1cab7e212476174fc749627cc5114ebaf3f92590
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-07-07 23:46:56 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-09-05 00:33:41 +0000

    pdptrace(2): allow debugging in capability mode
    
    (cherry picked from commit 7006cb7bd22d07d2ce30b0fb7ebfe58771b2a32f)
---
 sys/compat/freebsd32/freebsd32_misc.c |  3 ---
 sys/kern/sys_process.c                | 26 ++++++++++++++++++++++----
 sys/kern/syscalls.master              |  4 ++--
 3 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c
index 4da3b4ee97c1..bb4548660278 100644
--- a/sys/compat/freebsd32/freebsd32_misc.c
+++ b/sys/compat/freebsd32/freebsd32_misc.c
@@ -1050,9 +1050,6 @@ freebsd32_ptrace_useraction(struct thread *td, int req, bool pd_mode, pid_t pid,
 	void *addr;
 	int data, error, i;
 
-	if (!allow_ptrace)
-		return (ENOSYS);
-
 	error = 0;
 	addr = &r;
 	data = udata;
diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c
index 1bfa0f04959d..af8a7dafaf3e 100644
--- a/sys/kern/sys_process.c
+++ b/sys/kern/sys_process.c
@@ -51,6 +51,7 @@
 #include <sys/sleepqueue.h>
 #include <sys/sx.h>
 #include <sys/syscallsubr.h>
+#include <sys/sysctl.h>
 #include <sys/sysent.h>
 #include <sys/sysproto.h>
 #include <sys/vnode.h>
@@ -674,6 +675,24 @@ ptrace_vm_entry(struct thread *td, struct proc *p, struct ptrace_vm_entry *pve)
 	return (error);
 }
 
+static int
+ptrace_check_allowed(struct thread *td, int req, bool pd_mode, pid_t pid)
+{
+	if (!allow_ptrace)
+		return (ENOSYS);
+	if (!IN_CAPABILITY_MODE(td))
+		return (0);
+	if (!allow_ptrace_in_cap_mode)
+		return (ECAPMODE);
+	if (pd_mode)
+		return (0);
+	if (req == PT_GET_CHILDREN && pid == td->td_proc->p_pid)
+		return (0);
+	if (req == PT_CLEARSTEP && pid == td->td_tid)
+		return (0);
+	return (ECAPMODE);
+}
+
 /*
  * Process debugging system call.
  */
@@ -714,12 +733,11 @@ ptrace_useraction(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd,
 	void *addr;
 	int error, data;
 
-	if (!allow_ptrace)
-		return (ENOSYS);
+	error = ptrace_check_allowed(td, req, pd_mode, pid);
+	if (error != 0)
+		return (error);
 
-	error = 0;
 	addr = &r;
-
 	switch (req) {
 	case PT_GET_EVENT_MASK:
 	case PT_LWPINFO:
diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master
index 694f927989c2..b717f9029543 100644
--- a/sys/kern/syscalls.master
+++ b/sys/kern/syscalls.master
@@ -264,7 +264,7 @@
 25	AUE_GETEUID	STD|CAPENABLED {
 		uid_t geteuid(void);
 	}
-26	AUE_PTRACE	STD {
+26	AUE_PTRACE	STD|CAPENABLED {
 		int ptrace(
 		    int req,
 		    pid_t pid,
@@ -3435,7 +3435,7 @@
 			int flags
 		);
 	}
-605	AUE_PDPTRACE	STD {
+605	AUE_PDPTRACE	STD|CAPENABLED {
 		int pdptrace(
 			int req,
 			int pfd,