sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode

Adjust test to check for ECAPMODE using grandchild instead of child.
Childrens can be opened even in cap mode.  Add test for the later.

Reviewed by:	markj
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D58989

1 files changed, 34 insertions, 4 deletions

diff --git a/tests/sys/kern/procdesc.c b/tests/sys/kern/procdesc.c
index ef5746d544aa..862b8277913f 100644
--- a/tests/sys/kern/procdesc.c
+++ b/tests/sys/kern/procdesc.c
@@ -343,10 +343,10 @@ ATF_TC_BODY(pdopenpid_esrch, tc)
 }
 
 /*
- * pdopenpid should fail in capability mode.
+ * pdopenpid works for children in capability mode.
  */
-ATF_TC_WITHOUT_HEAD(pdopenpid_capmode);
-ATF_TC_BODY(pdopenpid_capmode, tc)
+ATF_TC_WITHOUT_HEAD(pdopenpid_child);
+ATF_TC_BODY(pdopenpid_child, tc)
 {
 	pid_t child, parent;
 
@@ -362,7 +362,36 @@ ATF_TC_BODY(pdopenpid_capmode, tc)
 	}
 
 	ATF_REQUIRE_MSG(cap_enter() == 0, "cap_enter: %s", strerror(errno));
-	ATF_REQUIRE_ERRNO(ECAPMODE, pdopenpid(child, 0) < 0);
+	ATF_REQUIRE_MSG(pdopenpid(child, 0) >= 0, "pdopenpid: %s",
+	    strerror(errno));
+}
+
+/*
+ * pdopenpid should fail in capability mode.
+ */
+ATF_TC_WITHOUT_HEAD(pdopenpid_capmode);
+ATF_TC_BODY(pdopenpid_capmode, tc)
+{
+	pid_t child, grandchild;
+
+	ATF_REQUIRE_FEATURE("security_capability_mode");
+
+	child = vfork();
+	ATF_REQUIRE_MSG(child >= 0, "fork: %s", strerror(errno));
+	if (child == 0) {
+		grandchild = fork();
+		ATF_REQUIRE_MSG(grandchild >= 0, "fork: %s", strerror(errno));
+		if (grandchild == 0) {
+			for (;;)
+				sleep(1);
+		} else {
+			_exit(0);
+		}
+	}
+
+	ATF_REQUIRE_MSG(cap_enter() == 0, "cap_enter: %s", strerror(errno));
+	ATF_REQUIRE_ERRNO(ECAPMODE, pdopenpid(grandchild, 0) < 0);
+	kill(grandchild, SIGKILL);
 }
 
 /*
@@ -759,6 +788,7 @@ ATF_TP_ADD_TCS(tp)
 	ATF_TP_ADD_TC(tp, pdopenpid_einval);
 	ATF_TP_ADD_TC(tp, pdopenpid_emfile);
 	ATF_TP_ADD_TC(tp, pdopenpid_esrch);
+	ATF_TP_ADD_TC(tp, pdopenpid_child);
 	ATF_TP_ADD_TC(tp, pdopenpid_capmode);
 	ATF_TP_ADD_TC(tp, pdopenpid_pdfork_then_open);
 	ATF_TP_ADD_TC(tp, pdopenpid_fork_then_open);