diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2026-07-07 23:46:56 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2026-08-28 11:55:11 +0000 |
| commit | 73c92a978ccef5e1683914510ea35e6e338646d1 (patch) | |
| tree | 4acf52be27e707ca88803cfe9917e49d19eeff31 | |
| parent | 7006cb7bd22d07d2ce30b0fb7ebfe58771b2a32f (diff) | |
pdopenpid(2): allow in capability mode with restrictions
The pdopenpid() syscall is allowed to open processes which are either
direct children of the caller, or are debuggees already attached to the
calling process. This is reasonable because we could have controlled the
child on fork anyway.
The procdesc-less debuggee can legitimately appear due to ptrace
FOLLOW-FORK mode.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
| -rw-r--r-- | sys/kern/sys_procdesc.c | 6 | ||||
| -rw-r--r-- | sys/kern/syscalls.master | 2 |
2 files changed, 7 insertions, 1 deletions
diff --git a/sys/kern/sys_procdesc.c b/sys/kern/sys_procdesc.c index 5ee8a4734248..b9329cd38088 100644 --- a/sys/kern/sys_procdesc.c +++ b/sys/kern/sys_procdesc.c @@ -665,6 +665,12 @@ pdopenpid1(struct thread *td, pid_t pid, struct procdesc **pdf, struct file *fp) PROC_UNLOCK(p); return (EBUSY); } + error = p_canopen(td, p); + if (error != 0) { + PROC_UNLOCK(p); + return (error); + } + pd = p->p_procdesc; if (pd != NULL) { MPASS((p->p_zombieref & PZOMBIEREF_PROCDESC) != 0); diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master index 656c73da348f..a3d16a6131c0 100644 --- a/sys/kern/syscalls.master +++ b/sys/kern/syscalls.master @@ -3429,7 +3429,7 @@ int flags ); } -603 AUE_PDOPENPID STD { +603 AUE_PDOPENPID STD|CAPENABLED { int pdopenpid( pid_t pid, int flags |