mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
kern: fix auditing of ptrace(2) syscall requests
`error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847
This commit is contained in:
1 parent
1bad1d8c14
commit
bcbbee810f
1 file changed
+1
-1
+1
-1
@@ -2766,7 +2766,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p,
|
||||
td->td_errno = nerror;
|
||||
|
||||
if (audited)
|
||||
AUDIT_SYSCALL_EXIT(error, td);
|
||||
AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td);
|
||||
if (!sy_thr_static)
|
||||
syscall_thread_exit(td, se);
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user