git: 326ab530dcab - main - pdopenpid(2): in cap mode, translate all errors from pdopenpid1() to ECAPMODE

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=326ab530dcabe70ab48728cad0465f35b30dbf60

commit 326ab530dcabe70ab48728cad0465f35b30dbf60
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-08-28 17:54:02 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-09-01 13:56:34 +0000

    pdopenpid(2): in cap mode, translate all errors from pdopenpid1() to ECAPMODE
    
    to not leak information about unused pids or system processes' pids.
    
    Reviewed by:    markj
    Fixes:  73c92a978cce ("pdopenpid(2): allow in capability mode with restrictions")
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D59252
---
 sys/kern/sys_procdesc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/kern/sys_procdesc.c b/sys/kern/sys_procdesc.c
index b9329cd38088..774774bdf4f0 100644
--- a/sys/kern/sys_procdesc.c
+++ b/sys/kern/sys_procdesc.c
@@ -728,7 +728,10 @@ kern_pdopenpid(struct thread *td, pid_t pid, int flags)
 			fp->f_pdflags |= F_PD_NOKILL | F_PD_NOFINSTALL;
 			filecaps_free(&fcaps);
 		}
+	} else if (IN_CAPABILITY_MODE(td)) {
+		error = ECAPMODE;
 	}
+
 	fdrop(fp, td);
 
 	if (pdf != NULL) {