From 73c92a978ccef5e1683914510ea35e6e338646d1 Mon Sep 17 00:00:00 2001
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Wed, 8 Jul 2026 02:46:56 +0300
Subject: [PATCH] pdopenpid(2): allow in capability mode with restrictions

The pdopenpid() syscall is allowed to open processes which are either
direct children of the caller, or are debuggees already attached to the
calling process. This is reasonable because we could have controlled the
child on fork anyway.

The procdesc-less debuggee can legitimately appear due to ptrace
FOLLOW-FORK mode.

Reviewed by:	markj
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D58989
---
 sys/kern/sys_procdesc.c  | 6 ++++++
 sys/kern/syscalls.master | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/sys/kern/sys_procdesc.c b/sys/kern/sys_procdesc.c
index 5ee8a4734248..b9329cd38088 100644
--- a/sys/kern/sys_procdesc.c
+++ b/sys/kern/sys_procdesc.c
@@ -665,6 +665,12 @@ pdopenpid1(struct thread *td, pid_t pid, struct procdesc **pdf, struct file *fp)
 		PROC_UNLOCK(p);
 		return (EBUSY);
 	}
+	error = p_canopen(td, p);
+	if (error != 0) {
+		PROC_UNLOCK(p);
+		return (error);
+	}
+
 	pd = p->p_procdesc;
 	if (pd != NULL) {
 		MPASS((p->p_zombieref & PZOMBIEREF_PROCDESC) != 0);
diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master
index 656c73da348f..a3d16a6131c0 100644
--- a/sys/kern/syscalls.master
+++ b/sys/kern/syscalls.master
@@ -3429,7 +3429,7 @@
 		    int flags
 		);
 	}
-603	AUE_PDOPENPID	STD {
+603	AUE_PDOPENPID	STD|CAPENABLED {
 		int pdopenpid(
 		    pid_t pid,
 		    int flags