src/lib/libc/sys/procctl.2, branch main

libsys: relocate implementations and manpages

2024-02-05T20:34:55Z

Remove core system call implementations and documentation to lib/libsys and lib/libsys/ from lib/libc/sys and lib/libc//. Update paths to allow libc to find them in their new home. Reviewed by: kib, emaste, imp Pull Request: https://github.com/freebsd/freebsd-src/pull/908

procctl.2: improve phrasing for ASLR disable

2023-10-26T17:40:08Z

Reported by: jrtc27 Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D42364

Remove $FreeBSD$: two-line nroff pattern

2023-08-16T17:55:10Z

Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/

procctl: add state flags to PROC_REAP_GETPIDS reports

2023-04-16T10:48:20Z

For a process supervisor using the reaper API to track process subtrees, it is very useful to know the state of the processes on the list. Sponsored by: https://www.patreon.com/valpackett Reviewed by: kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D39585

procctl: actually require debug privileges over target

2021-10-19T20:04:34Z

for state control over TRACE, TRAPCAP, ASLR, PROTMAX, STACKGAP, NO_NEWPRIVS, and WXMAP. Reported by: emaste Reviewed by: emaste, markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D32513

procctl(2): add consistent shortcut P_ID:0 as curproc

2021-10-19T20:04:34Z

Reported by: bdrewery, emaste Reviewed by: emaste, markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D32513

procctl(2): Add PROC_WXMAP_CTL/STATUS

2021-09-17T12:42:01Z

It allows to override kern.elf{32,64}.allow_wx on per-process basis. In particular, it makes it possible to run binaries without PT_GNU_STACK and without elfctl note while allow_wx = 0. Reviewed by: brooks, emaste, markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D31779

Pass the syscall number to capsicum permission-denied signals

2021-07-16T17:06:44Z

The syscall number is stored in the same register as the syscall return on amd64 (and possibly other architectures) and so it is impossible to recover in the signal handler after the call has returned. This small tweak delivers it in the `si_value` field of the signal, which is sufficient to catch capability violations and emulate them with a call to a more-privileged process in the signal handler. This reapplies 3a522ba1bc852c3d4660a4fa32e4a94999d09a47 with a fix for the static assertion failure on i386. Approved by: markj (mentor) Reviewed by: kib, bcr (manpages) Differential Revision: https://reviews.freebsd.org/D29185

Revert "Pass the syscall number to capsicum permission-denied signals"

2021-07-10T19:26:01Z

This broke the i386 build. This reverts commit 3a522ba1bc852c3d4660a4fa32e4a94999d09a47.

Pass the syscall number to capsicum permission-denied signals

2021-07-10T16:19:52Z

The syscall number is stored in the same register as the syscall return on amd64 (and possibly other architectures) and so it is impossible to recover in the signal handler after the call has returned. This small tweak delivers it in the `si_value` field of the signal, which is sufficient to catch capability violations and emulate them with a call to a more-privileged process in the signal handler. Approved by: markj (mentor) Reviewed by: kib, bcr (manpages) Differential Revision: https://reviews.freebsd.org/D29185