hwpmc: Fix the execve handler

When a process execve()s, pmc_process_exec() is supposed to evaluate
whether the new image is setuid/setgid and if so, whether to detach
PMCs.  This was handled by pmc_can_attach(), which is effectively an
open-coded copy of cr_xids_subset().

Unfortunately, the test of the result of this function was inverted,
with the result that we'd detach PMCs only if the predicate said it was
okay to do so.  It appears the bug has always been there; it seems the
intent was to return 0 on "success", i.e., it is okay to attach the
PMCs, much like p_candebug().  Commits 1c3c698ba4c4 and 1c40b15971f0
obscured this a bit.

I think this check is trying to be too clever.  Let's make it simpler:
simply do not attach PMCs unless the owner is privileged.  This is how,
e.g., ktrace works.  I do not think it's worth trying to be more
sophisticated than this unless we can generalize the policy in a way
that's applicable to other subsystems.

Also fix a bug at the end of pmc_process_exec():
pmc_detach_one_process() will call pmc_remove_process_descriptor() for
us.

Approved by:	so
Security:	FreeBSD-SA-26:56.hwpmc
Security:	CVE-2026-58089
Reported by:	netchild
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D59102

0 files changed, 0 insertions, 0 deletions