git: 5f82dd8e9161 - main - capsicum: add CAP_PTRACE

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=5f82dd8e91610ceafe7ddbc702d97ffe7573f53f

commit 5f82dd8e91610ceafe7ddbc702d97ffe7573f53f
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-07-07 23:46:28 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-08-28 11:52:31 +0000

    capsicum: add CAP_PTRACE
    
    The capability will allow the ptrace(2) on the procdesc.
    
    Reviewed by:    markj
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D58586
---
 sys/kern/subr_capability.c | 1 +
 sys/sys/caprights.h        | 1 +
 sys/sys/capsicum.h         | 8 +++++---
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/sys/kern/subr_capability.c b/sys/kern/subr_capability.c
index 55d6225fd67a..f5242216a2a2 100644
--- a/sys/kern/subr_capability.c
+++ b/sys/kern/subr_capability.c
@@ -93,6 +93,7 @@ const cap_rights_t cap_pdgetpid_rights = CAP_RIGHTS_INITIALIZER(CAP_PDGETPID);
 const cap_rights_t cap_pdkill_rights = CAP_RIGHTS_INITIALIZER(CAP_PDKILL);
 const cap_rights_t cap_pdwait_rights = CAP_RIGHTS_INITIALIZER(CAP_PDWAIT);
 const cap_rights_t cap_pread_rights = CAP_RIGHTS_INITIALIZER(CAP_PREAD);
+const cap_rights_t cap_ptrace_rights = CAP_RIGHTS_INITIALIZER(CAP_PTRACE);
 const cap_rights_t cap_pwrite_rights = CAP_RIGHTS_INITIALIZER(CAP_PWRITE);
 const cap_rights_t cap_read_rights = CAP_RIGHTS_INITIALIZER(CAP_READ);
 const cap_rights_t cap_recv_rights = CAP_RIGHTS_INITIALIZER(CAP_RECV);
diff --git a/sys/sys/caprights.h b/sys/sys/caprights.h
index 296fac3b6231..09cce5fa8c5c 100644
--- a/sys/sys/caprights.h
+++ b/sys/sys/caprights.h
@@ -95,6 +95,7 @@ extern const cap_rights_t cap_pdgetpid_rights;
 extern const cap_rights_t cap_pdkill_rights;
 extern const cap_rights_t cap_pdwait_rights;
 extern const cap_rights_t cap_pread_rights;
+extern const cap_rights_t cap_ptrace_rights;
 extern const cap_rights_t cap_pwrite_rights;
 extern const cap_rights_t cap_read_rights;
 extern const cap_rights_t cap_recv_rights;
diff --git a/sys/sys/capsicum.h b/sys/sys/capsicum.h
index aa3f2f1bccdf..d912d10bc4e2 100644
--- a/sys/sys/capsicum.h
+++ b/sys/sys/capsicum.h
@@ -299,7 +299,9 @@
 /* Allows pddupfd(2). */
 #define	CAP_PDDUPFD		CAPRIGHT(1, 0x0000000000800000ULL)
 
-#define	CAP_UNUSED1_25		CAPRIGHT(1, 0x0000000001000000ULL)
+/* Allows ptrace(PT_PROCDESC) */
+#define	CAP_PTRACE		CAPRIGHT(1, 0x0000000001000000ULL)
+
 #define	CAP_UNUSED1_26		CAPRIGHT(1, 0x0000000002000000ULL)
 #define	CAP_UNUSED1_27		CAPRIGHT(1, 0x0000000004000000ULL)
 #define	CAP_UNUSED1_28		CAPRIGHT(1, 0x0000000008000000ULL)
@@ -333,8 +335,8 @@
 #define	CAP_UNUSED1_56		CAPRIGHT(1, 0x0080000000000000ULL)
 #define	CAP_UNUSED1_57		CAPRIGHT(1, 0x0100000000000000ULL)
 
-/* All used bits for index 1. */
-#define	CAP_ALL1		CAPRIGHT(1, 0x0000000000FFFFFFULL)
+/* All default bits for index 1. */
+#define	CAP_ALL1		CAPRIGHT(1, 0x0000000001FFFFFFULL)
 
 /* Backward compatibility. */
 #define	CAP_POLL_EVENT		CAP_EVENT