The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=7006cb7bd22d07d2ce30b0fb7ebfe58771b2a32f
commit 7006cb7bd22d07d2ce30b0fb7ebfe58771b2a32f Author: Konstantin Belousov <[email protected]> AuthorDate: 2026-07-07 23:46:56 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-08-28 11:55:11 +0000 pdptrace(2): allow debugging in capability mode The pdopenpid(2) syscall is allowed in capability mode. Add the chicken switch security.bsd.ptrace_in_cap_mode, which disables it without reboot, if needed. The descriptor passed to pdptrace(2) must have the CAP_PTRACE capability enabled. This capability is not enabled by default by pdfork()/pdopenpid(), and the calls do not return a procdesc suitable for debugging. The opening code must prepare for debugging in advance by passing the PD_PTRACE_CAP flag to pdfork()/pdopenpid(). For ptrace(2), allow PT_CLEARSTEP and PT_GET_CHILDREN for the current thread and process in cap mode as well. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58989 --- sys/compat/freebsd32/freebsd32_misc.c | 3 --- sys/kern/sys_process.c | 26 ++++++++++++++++++++++---- sys/kern/syscalls.master | 4 ++-- 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c index 4da3b4ee97c1..bb4548660278 100644 --- a/sys/compat/freebsd32/freebsd32_misc.c +++ b/sys/compat/freebsd32/freebsd32_misc.c @@ -1050,9 +1050,6 @@ freebsd32_ptrace_useraction(struct thread *td, int req, bool pd_mode, pid_t pid, void *addr; int data, error, i; - if (!allow_ptrace) - return (ENOSYS); - error = 0; addr = &r; data = udata; diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c index 35aa376fb6f5..5c8f32773412 100644 --- a/sys/kern/sys_process.c +++ b/sys/kern/sys_process.c @@ -51,6 +51,7 @@ #include <sys/sleepqueue.h> #include <sys/sx.h> #include <sys/syscallsubr.h> +#include <sys/sysctl.h> #include <sys/sysent.h> #include <sys/sysproto.h> #include <sys/vnode.h> @@ -708,6 +709,24 @@ ptrace_vm_entry(struct thread *td, struct proc *p, struct ptrace_vm_entry *pve) return (error); } +static int +ptrace_check_allowed(struct thread *td, int req, bool pd_mode, pid_t pid) +{ + if (!allow_ptrace) + return (ENOSYS); + if (!IN_CAPABILITY_MODE(td)) + return (0); + if (!allow_ptrace_in_cap_mode) + return (ECAPMODE); + if (pd_mode) + return (0); + if (req == PT_GET_CHILDREN && pid == td->td_proc->p_pid) + return (0); + if (req == PT_CLEARSTEP && pid == td->td_tid) + return (0); + return (ECAPMODE); +} + /* * Process debugging system call. */ @@ -748,12 +767,11 @@ ptrace_useraction(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd, void *addr; int error, data; - if (!allow_ptrace) - return (ENOSYS); + error = ptrace_check_allowed(td, req, pd_mode, pid); + if (error != 0) + return (error); - error = 0; addr = &r; - switch (req) { case PT_GET_EVENT_MASK: case PT_LWPINFO: diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master index 7050e564903e..656c73da348f 100644 --- a/sys/kern/syscalls.master +++ b/sys/kern/syscalls.master @@ -264,7 +264,7 @@ 25 AUE_GETEUID STD|CAPENABLED { uid_t geteuid(void); } -26 AUE_PTRACE STD { +26 AUE_PTRACE STD|CAPENABLED { int ptrace( int req, pid_t pid, @@ -3442,7 +3442,7 @@ int flags ); } -605 AUE_PDPTRACE STD { +605 AUE_PDPTRACE STD|CAPENABLED { int pdptrace( int req, int pfd,
