The branch stable/15 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=1cab7e212476174fc749627cc5114ebaf3f92590
commit 1cab7e212476174fc749627cc5114ebaf3f92590 Author: Konstantin Belousov <[email protected]> AuthorDate: 2026-07-07 23:46:56 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-09-05 00:33:41 +0000 pdptrace(2): allow debugging in capability mode (cherry picked from commit 7006cb7bd22d07d2ce30b0fb7ebfe58771b2a32f) --- sys/compat/freebsd32/freebsd32_misc.c | 3 --- sys/kern/sys_process.c | 26 ++++++++++++++++++++++---- sys/kern/syscalls.master | 4 ++-- 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c index 4da3b4ee97c1..bb4548660278 100644 --- a/sys/compat/freebsd32/freebsd32_misc.c +++ b/sys/compat/freebsd32/freebsd32_misc.c @@ -1050,9 +1050,6 @@ freebsd32_ptrace_useraction(struct thread *td, int req, bool pd_mode, pid_t pid, void *addr; int data, error, i; - if (!allow_ptrace) - return (ENOSYS); - error = 0; addr = &r; data = udata; diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c index 1bfa0f04959d..af8a7dafaf3e 100644 --- a/sys/kern/sys_process.c +++ b/sys/kern/sys_process.c @@ -51,6 +51,7 @@ #include <sys/sleepqueue.h> #include <sys/sx.h> #include <sys/syscallsubr.h> +#include <sys/sysctl.h> #include <sys/sysent.h> #include <sys/sysproto.h> #include <sys/vnode.h> @@ -674,6 +675,24 @@ ptrace_vm_entry(struct thread *td, struct proc *p, struct ptrace_vm_entry *pve) return (error); } +static int +ptrace_check_allowed(struct thread *td, int req, bool pd_mode, pid_t pid) +{ + if (!allow_ptrace) + return (ENOSYS); + if (!IN_CAPABILITY_MODE(td)) + return (0); + if (!allow_ptrace_in_cap_mode) + return (ECAPMODE); + if (pd_mode) + return (0); + if (req == PT_GET_CHILDREN && pid == td->td_proc->p_pid) + return (0); + if (req == PT_CLEARSTEP && pid == td->td_tid) + return (0); + return (ECAPMODE); +} + /* * Process debugging system call. */ @@ -714,12 +733,11 @@ ptrace_useraction(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd, void *addr; int error, data; - if (!allow_ptrace) - return (ENOSYS); + error = ptrace_check_allowed(td, req, pd_mode, pid); + if (error != 0) + return (error); - error = 0; addr = &r; - switch (req) { case PT_GET_EVENT_MASK: case PT_LWPINFO: diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master index 694f927989c2..b717f9029543 100644 --- a/sys/kern/syscalls.master +++ b/sys/kern/syscalls.master @@ -264,7 +264,7 @@ 25 AUE_GETEUID STD|CAPENABLED { uid_t geteuid(void); } -26 AUE_PTRACE STD { +26 AUE_PTRACE STD|CAPENABLED { int ptrace( int req, pid_t pid, @@ -3435,7 +3435,7 @@ int flags ); } -605 AUE_PDPTRACE STD { +605 AUE_PDPTRACE STD|CAPENABLED { int pdptrace( int req, int pfd,
