git: 2fbb853ec71e - stable/15 - sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode

The branch stable/15 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=2fbb853ec71e71bfa6e6194781ffc66f1fde9968

commit 2fbb853ec71e71bfa6e6194781ffc66f1fde9968
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-08-28 08:37:19 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-09-05 00:33:44 +0000

    sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode
    
    (cherry picked from commit ddf62c83fc0aca39a1bfd8346ad6e925bfb2290e)
---
 tests/sys/kern/procdesc.c | 38 ++++++++++++++++++++++++++++++++++----
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/tests/sys/kern/procdesc.c b/tests/sys/kern/procdesc.c
index b78e903adb7c..35494911a9fc 100644
--- a/tests/sys/kern/procdesc.c
+++ b/tests/sys/kern/procdesc.c
@@ -341,10 +341,10 @@ ATF_TC_BODY(pdopenpid_esrch, tc)
 }
 
 /*
- * pdopenpid should fail in capability mode.
+ * pdopenpid works for children in capability mode.
  */
-ATF_TC_WITHOUT_HEAD(pdopenpid_capmode);
-ATF_TC_BODY(pdopenpid_capmode, tc)
+ATF_TC_WITHOUT_HEAD(pdopenpid_child);
+ATF_TC_BODY(pdopenpid_child, tc)
 {
 	pid_t child, parent;
 
@@ -358,7 +358,36 @@ ATF_TC_BODY(pdopenpid_capmode, tc)
 	}
 
 	ATF_REQUIRE_MSG(cap_enter() == 0, "cap_enter: %s", strerror(errno));
-	ATF_REQUIRE_ERRNO(ECAPMODE, pdopenpid(child, 0) < 0);
+	ATF_REQUIRE_MSG(pdopenpid(child, 0) >= 0, "pdopenpid: %s",
+	    strerror(errno));
+}
+
+/*
+ * pdopenpid should fail in capability mode.
+ */
+ATF_TC_WITHOUT_HEAD(pdopenpid_capmode);
+ATF_TC_BODY(pdopenpid_capmode, tc)
+{
+	pid_t child, grandchild;
+
+	ATF_REQUIRE_FEATURE("security_capability_mode");
+
+	child = vfork();
+	ATF_REQUIRE_MSG(child >= 0, "fork: %s", strerror(errno));
+	if (child == 0) {
+		grandchild = fork();
+		ATF_REQUIRE_MSG(grandchild >= 0, "fork: %s", strerror(errno));
+		if (grandchild == 0) {
+			for (;;)
+				sleep(1);
+		} else {
+			_exit(0);
+		}
+	}
+
+	ATF_REQUIRE_MSG(cap_enter() == 0, "cap_enter: %s", strerror(errno));
+	ATF_REQUIRE_ERRNO(ECAPMODE, pdopenpid(grandchild, 0) < 0);
+	kill(grandchild, SIGKILL);
 }
 
 /*
@@ -755,6 +784,7 @@ ATF_TP_ADD_TCS(tp)
 	ATF_TP_ADD_TC(tp, pdopenpid_einval);
 	ATF_TP_ADD_TC(tp, pdopenpid_emfile);
 	ATF_TP_ADD_TC(tp, pdopenpid_esrch);
+	ATF_TP_ADD_TC(tp, pdopenpid_child);
 	ATF_TP_ADD_TC(tp, pdopenpid_capmode);
 	ATF_TP_ADD_TC(tp, pdopenpid_pdfork_then_open);
 	ATF_TP_ADD_TC(tp, pdopenpid_fork_then_open);