diff options
| author | Alexander Leidinger <netchild@FreeBSD.org> | 2026-07-17 21:33:00 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-07-29 17:45:02 +0000 |
| commit | 490365e5d076db13e9fed085bbc5b649ad261fd1 (patch) | |
| tree | 93237ba51e40a7dd1558471b894a70e6e3b0f992 | |
| parent | db3afbe5a6efce56fb30dd117de54d3dd6a61f37 (diff) | |
jail: restore ktrace privileges for jailed root
Commit 4be491e1b9b3 ("jail: Optionally allow audit session state to
be configured in a jail") removed the #if 0 around the audit cases
in prison_priv_check() and added the PR_ALLOW_SETAUDIT check under
them. This unintentionally captured the preceding case PRIV_KTRACE,
which used to fall through the disabled block into the unconditional
return (0) of the credential cases: since then, jailed root only has
ktrace privileges (tracing processes with changed credentials, see
ktrcanset()) when the unrelated allow.setaudit knob is enabled, and
conversely gains them when that audit knob is turned on.
Give PRIV_KTRACE back its own unconditional return (0), matching its
comment and the pre-4be491e1b9b3 behaviour.
Approved by: so
Security: FreeBSD-SA-26:53.ktrace
Security: CVE-2026-58086
Fixes: 4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail")
Reviewed by: markj
Assisted-by: Claude Code (Fable 5)
| -rw-r--r-- | sys/kern/kern_jail.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index dd4df0353015..c1ead6475916 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -4527,6 +4527,7 @@ prison_priv_check(struct ucred *cred, int priv) * Allow ktrace privileges for root in jail. */ case PRIV_KTRACE: + return (0); /* * Allow jailed processes to configure audit identity and |