pdopenpid(2): allow in capability mode with restrictions

The pdopenpid() syscall is allowed to open processes which are either
direct children of the caller, or are debuggees already attached to the
calling process. This is reasonable because we could have controlled the
child on fork anyway.

The procdesc-less debuggee can legitimately appear due to ptrace
FOLLOW-FORK mode.

Reviewed by:	markj
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D58989

sys/kern/sys_procdesc.c

@@ -665,6 +665,12 @@ pdopenpid1(struct thread *td, pid_t pid, struct procdesc **pdf, struct file *fp)
 		PROC_UNLOCK(p);
 		return (EBUSY);
 	}
+	error = p_canopen(td, p);
+	if (error != 0) {
+		PROC_UNLOCK(p);
+		return (error);
+	}
+
 	pd = p->p_procdesc;
 	if (pd != NULL) {
 		MPASS((p->p_zombieref & PZOMBIEREF_PROCDESC) != 0);

sys/kern/syscalls.master

@@ -3429,7 +3429,7 @@
 		    int flags
 		);
 	}
-603	AUE_PDOPENPID	STD {
+603	AUE_PDOPENPID	STD|CAPENABLED {
 		int pdopenpid(
 		    pid_t pid,
 		    int flags