The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=ddf62c83fc0aca39a1bfd8346ad6e925bfb2290e
commit ddf62c83fc0aca39a1bfd8346ad6e925bfb2290e Author: Konstantin Belousov <[email protected]> AuthorDate: 2026-08-28 08:37:19 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-08-28 11:55:11 +0000 sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode Adjust test to check for ECAPMODE using grandchild instead of child. Childrens can be opened even in cap mode. Add test for the later. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58989 --- tests/sys/kern/procdesc.c | 38 ++++++++++++++++++++++++++++++++++---- 1 file changed, 34 insertions(+), 4 deletions(-) diff --git a/tests/sys/kern/procdesc.c b/tests/sys/kern/procdesc.c index ef5746d544aa..862b8277913f 100644 --- a/tests/sys/kern/procdesc.c +++ b/tests/sys/kern/procdesc.c @@ -343,10 +343,10 @@ ATF_TC_BODY(pdopenpid_esrch, tc) } /* - * pdopenpid should fail in capability mode. + * pdopenpid works for children in capability mode. */ -ATF_TC_WITHOUT_HEAD(pdopenpid_capmode); -ATF_TC_BODY(pdopenpid_capmode, tc) +ATF_TC_WITHOUT_HEAD(pdopenpid_child); +ATF_TC_BODY(pdopenpid_child, tc) { pid_t child, parent; @@ -362,7 +362,36 @@ ATF_TC_BODY(pdopenpid_capmode, tc) } ATF_REQUIRE_MSG(cap_enter() == 0, "cap_enter: %s", strerror(errno)); - ATF_REQUIRE_ERRNO(ECAPMODE, pdopenpid(child, 0) < 0); + ATF_REQUIRE_MSG(pdopenpid(child, 0) >= 0, "pdopenpid: %s", + strerror(errno)); +} + +/* + * pdopenpid should fail in capability mode. + */ +ATF_TC_WITHOUT_HEAD(pdopenpid_capmode); +ATF_TC_BODY(pdopenpid_capmode, tc) +{ + pid_t child, grandchild; + + ATF_REQUIRE_FEATURE("security_capability_mode"); + + child = vfork(); + ATF_REQUIRE_MSG(child >= 0, "fork: %s", strerror(errno)); + if (child == 0) { + grandchild = fork(); + ATF_REQUIRE_MSG(grandchild >= 0, "fork: %s", strerror(errno)); + if (grandchild == 0) { + for (;;) + sleep(1); + } else { + _exit(0); + } + } + + ATF_REQUIRE_MSG(cap_enter() == 0, "cap_enter: %s", strerror(errno)); + ATF_REQUIRE_ERRNO(ECAPMODE, pdopenpid(grandchild, 0) < 0); + kill(grandchild, SIGKILL); } /* @@ -759,6 +788,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, pdopenpid_einval); ATF_TP_ADD_TC(tp, pdopenpid_emfile); ATF_TP_ADD_TC(tp, pdopenpid_esrch); + ATF_TP_ADD_TC(tp, pdopenpid_child); ATF_TP_ADD_TC(tp, pdopenpid_capmode); ATF_TP_ADD_TC(tp, pdopenpid_pdfork_then_open); ATF_TP_ADD_TC(tp, pdopenpid_fork_then_open);
