git: 24816abb8740 - main - syslogd: Limit rights on procdescs

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=24816abb8740c387ad4aba4ad2fa4c23b191c351

commit 24816abb8740c387ad4aba4ad2fa4c23b191c351
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-10 20:25:54 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-10 21:21:59 +0000

    syslogd: Limit rights on procdescs
    
    Reviewed by:    jfree, kib
    MFC after:      3 weeks
    Differential Revision:  https://reviews.freebsd.org/D58160
---
 usr.sbin/syslogd/syslogd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
index 19190124c8b4..e3d144a532b5 100644
--- a/usr.sbin/syslogd/syslogd.c
+++ b/usr.sbin/syslogd/syslogd.c
@@ -3772,6 +3772,7 @@ validate(struct sockaddr *sa, const char *hname)
 int
 p_open(const char *prog, int *rpd)
 {
+	cap_rights_t rights;
 	struct sigaction act = { };
 	int pfd[2], pd;
 	pid_t pid;
@@ -3823,6 +3824,10 @@ p_open(const char *prog, int *rpd)
 		dprintf("Warning: cannot change pipe to PID %d to non-blocking"
 		    "behaviour.", pid);
 	}
+
+	if (cap_rights_limit(pd,
+	    cap_rights_init(&rights, CAP_PDKILL, CAP_EVENT)) == -1)
+		err(1, "cap_rights_limit");
 	*rpd = pd;
 	return (pfd[1]);
 }