git: 73c92a978cce - main - pdopenpid(2): allow in capability mode with restrictions

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=73c92a978ccef5e1683914510ea35e6e338646d1

commit 73c92a978ccef5e1683914510ea35e6e338646d1
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-07-07 23:46:56 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-08-28 11:55:11 +0000

    pdopenpid(2): allow in capability mode with restrictions
    
    The pdopenpid() syscall is allowed to open processes which are either
    direct children of the caller, or are debuggees already attached to the
    calling process. This is reasonable because we could have controlled the
    child on fork anyway.
    
    The procdesc-less debuggee can legitimately appear due to ptrace
    FOLLOW-FORK mode.
    
    Reviewed by:    markj
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D58989
---
 sys/kern/sys_procdesc.c  | 6 ++++++
 sys/kern/syscalls.master | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/sys/kern/sys_procdesc.c b/sys/kern/sys_procdesc.c
index 5ee8a4734248..b9329cd38088 100644
--- a/sys/kern/sys_procdesc.c
+++ b/sys/kern/sys_procdesc.c
@@ -665,6 +665,12 @@ pdopenpid1(struct thread *td, pid_t pid, struct procdesc **pdf, struct file *fp)
 		PROC_UNLOCK(p);
 		return (EBUSY);
 	}
+	error = p_canopen(td, p);
+	if (error != 0) {
+		PROC_UNLOCK(p);
+		return (error);
+	}
+
 	pd = p->p_procdesc;
 	if (pd != NULL) {
 		MPASS((p->p_zombieref & PZOMBIEREF_PROCDESC) != 0);
diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master
index 656c73da348f..a3d16a6131c0 100644
--- a/sys/kern/syscalls.master
+++ b/sys/kern/syscalls.master
@@ -3429,7 +3429,7 @@
 		    int flags
 		);
 	}
-603	AUE_PDOPENPID	STD {
+603	AUE_PDOPENPID	STD|CAPENABLED {
 		int pdopenpid(
 		    pid_t pid,
 		    int flags