diff options
| -rw-r--r-- | sys/miscfs/procfs/procfs_ctl.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/sys/miscfs/procfs/procfs_ctl.c b/sys/miscfs/procfs/procfs_ctl.c index 4f4d84bf02af..09a30bdadf27 100644 --- a/sys/miscfs/procfs/procfs_ctl.c +++ b/sys/miscfs/procfs/procfs_ctl.c @@ -111,6 +111,19 @@ procfs_control(curp, p, op) { int error; + /* Authorization check: rely on normal debugging protection, except + * allow processes to disecgage debugging on a process onto which + * they have previously attached, but no longer have permission to + * debug. + */ + if (op != PROCFS_CTL_DETACH) { + if (securelevel > 0 && p->p_pid == 1) + return (EPERM); + + if (!CHECKIO(curp, p) || !procfs_kmemaccess(curp)) + return (EPERM); + } + /* * Attach - attaches the target process for debugging * by the calling process. @@ -124,10 +137,6 @@ procfs_control(curp, p, op) if (p->p_pid == curp->p_pid) return (EINVAL); - /* can't trace init when securelevel > 0 */ - if (securelevel > 0 && p->p_pid == 1) - return (EPERM); - /* * Go ahead and set the trace flag. * Save the old parent (it's reset in |