From nobody Tue Jun 30 17:20:16 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJw6Wgbz6jXnp for ; Tue, 30 Jun 2026 17:20:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJw18VMz3q0R for ; Tue, 30 Jun 2026 17:20:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840016; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nRscvlWqLXMpAuf+I3lwHfWQiWu+yR1yzWgc8VpUyjQ=; b=tNMU/9X1yhoW8dQ9K8K2XoLP8Xc2uwDFMUccsJ4RlRC3x/z6vz1Bzb/EKP/toQtMf9KfRI T6I37nI0VeLonE10F8rduP4mxWISTniJAr7u8EAEnPeQ/uSCKyQcu8JtvZV6zWux4voVJL eWjj6lizHQtT5aB+MdN4l1CXi9IXtcCNY9PHLeO5jtECALJv8j1hrW8Ywmq6TvzTtZOLzw aIBpMRAWg52y39sJCvl8R4urLWsfc34OzpmlxZ0aG0byeX4VJV2NKJXiW1Dm5ZreEm3ElS I+ZTg/qV5le0auAOHxNW4Y6CVRt8YeATKbo+SNNtS67hGCsQMu1y9ZzPACmYSg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840016; a=rsa-sha256; cv=none; b=Hoc9nL3ayHb5pj9YjngzJVoPy7BLz5gTfZMOXAh9Q1uaVe3C3HPIQ9bWWFdmt8f63/gMAE fSM5MJ1y+6cVSZ3W8JO5ys9HLPBOlCs3WeMo2LDueeO2BXqD21lY4fac+5+WTerAZ62MUu GbiPWZq5QpG7+pKaEfguk/kvRI/DBjZLzwYg2nwSBqEYPgCTI8XFpQhSrFQor9RGrKbeIh WuVF2S6dCM0fM9QNB/7v+vJn7GjgZrlfv3Gi+PMS9YTBFa96dXW5JlfPUHPHIG1W31yGg4 z8sMu2hsfKsuHEChQi+goP6gGyPbrfWY+DW42tODJaWkOYW+cm8B1G0saIe/aw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840016; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nRscvlWqLXMpAuf+I3lwHfWQiWu+yR1yzWgc8VpUyjQ=; b=gY9Uj6HAmlh5Utvfapp+2cGyTZXUOwt7nm9NFkRYg5jdk7BNH2XYl3BJukvIknFX7XkRUW EaeFpDo3WG8Aro0wqrwYhWrcvzbXVz4F4nmgEsyscpmyIgK99mop6O51rz8qTZztD3CMQ3 dqXM8IFcUppuCKN+2RkXwbVJojJuPmAo9Bj0izB2vFHo2R0hkdCRx8GwsFSt5d7G+2FatF +lcSXOncGgHHbnZIhmYS8mnfRn6FZKPJXutZZAu74q8CGBtJRXJ7CJ9BK95nR07D+XTb1z Sq5xV5xkdPUWt4y9EmgdyprHWVTWNZW2Z27Nrd8qQtCIOSLg63QrfUj5LCEEew== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJw0D53ztV9 for ; Tue, 30 Jun 2026 17:20:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f4f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: ec1989960781 - stable/15 - kern: fix auditing of ptrace(2) syscall requests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ec19899607813702d94b13798a9ed78dffdce719 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:16 +0000 Message-Id: <6a43fad0.44f4f.6304858d@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=ec19899607813702d94b13798a9ed78dffdce719 commit ec19899607813702d94b13798a9ed78dffdce719 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index e48997ed966a..fed5b62ee1c7 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2766,7 +2766,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); }