From nobody Wed Jul 29 17:47:57 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h9KYV2YW3z6mZkG for ; Wed, 29 Jul 2026 17:47:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h9KYV17BBz3fvf for ; Wed, 29 Jul 2026 17:47:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785347278; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yrNusZ8diLrx+HOfi/UWkX3wX4+z7Hr7INtuwabeiJs=; b=XoAsORt/l3/ANwMwieQHZyjfEna8OnQRTB2pUD8XcEToAuJYRE1LJHTGs46F/lXDuHvDNr JcATyiADEYP7/Yjy8UPYgV8gwy0SJMf+l5RgbUl7Sq/3/jNS2OkDEuvbcrV1R4DbrQ4DVA NwZk7M+W7KVpzdaU7FJhX5BH2UAv9joV3PRelaiwA5LjJoI/cLyF0+MUHkm35woMHzBdc7 mSBNsRkyJuO6YisfnY/XE49WfkNSSnTIRdOzFVa0tThxvuQbCQPpu7FZW95PExXO1Bt3rT Urr3EiKwR6Fwhjuu6+o+xIuKh3Za9SvkKxYU/BbQ7PYQJHMWRlENVMmjutjUcw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785347278; a=rsa-sha256; cv=none; b=BAoppiMUSs0WRAYaXYg5on2irzjSkCODwti5B0z1MRN5RigEQrr3Zo3ahfAs7L7kttsV3m UV2js9uKqqLEX2TWrK9Sv+LxCabf0aPj8x7zwcGIZyGRNV4QxLbb8F567Xvz6uYn+s/3uH WQ24Ldr6tMiZlSVuBOpKa5UEivRgjM7+hJI43Qo0TvvmCuWp5lYStfxLXfEtcDahziTIDK tHVnuktX1o6VTPHXa16Br53R0MvlOzs/Pxwl3Kg/b+56begPXHdpchYZO/0sKHM+/VWgRu Qq9MgfaFQha0sXUows0244Mu5f3KUbhkYatEGUL+hvo2GCkzVv926o/Zl+wmmQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785347278; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yrNusZ8diLrx+HOfi/UWkX3wX4+z7Hr7INtuwabeiJs=; b=ecXKIAQbKUf7zGrCgHxowJX8GurkSfzTntobmpaiJsaeBQhkfeyDXzhp+jl8f5xiyNO2Sr A9JKhgV6gJnVA/FRAxZlv0ka8e+SV84/cil8UfkeT2DmlvgE7MribclvQT/5HG1fLb7Tf+ Ml2biZo5MxyBtRmWJZlTn5LHDOVG3mUznJnVSkqUj1AUeRIkH+ZqB9TFrQ/zmy+DmJj/Fa kuzzmoPf+sf0juuDsmg/3Z8xDb4wFOZ8OA73tPp66x3GNQqPwGP7UnAwKgWe8eA2Qt9ZYs gwx9cXyJGrNCm93ME9mH9WLLlapssFIh9Dm40hjqj+XpPrpW9YixZEqJKOuf3w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h9KYT74SQzcvm for ; Wed, 29 Jul 2026 17:47:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3a5cf by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 29 Jul 2026 17:47:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Alexander Leidinger From: Mark Johnston Subject: git: 490365e5d076 - main - jail: restore ktrace privileges for jailed root List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 490365e5d076db13e9fed085bbc5b649ad261fd1 Auto-Submitted: auto-generated Date: Wed, 29 Jul 2026 17:47:57 +0000 Message-Id: <6a6a3ccd.3a5cf.290f4763@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=490365e5d076db13e9fed085bbc5b649ad261fd1 commit 490365e5d076db13e9fed085bbc5b649ad261fd1 Author: Alexander Leidinger AuthorDate: 2026-07-17 21:33:00 +0000 Commit: Mark Johnston CommitDate: 2026-07-29 17:45:02 +0000 jail: restore ktrace privileges for jailed root Commit 4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail") removed the #if 0 around the audit cases in prison_priv_check() and added the PR_ALLOW_SETAUDIT check under them. This unintentionally captured the preceding case PRIV_KTRACE, which used to fall through the disabled block into the unconditional return (0) of the credential cases: since then, jailed root only has ktrace privileges (tracing processes with changed credentials, see ktrcanset()) when the unrelated allow.setaudit knob is enabled, and conversely gains them when that audit knob is turned on. Give PRIV_KTRACE back its own unconditional return (0), matching its comment and the pre-4be491e1b9b3 behaviour. Approved by: so Security: FreeBSD-SA-26:53.ktrace Security: CVE-2026-58086 Fixes: 4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail") Reviewed by: markj Assisted-by: Claude Code (Fable 5) --- sys/kern/kern_jail.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index dd4df0353015..c1ead6475916 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -4527,6 +4527,7 @@ prison_priv_check(struct ucred *cred, int priv) * Allow ktrace privileges for root in jail. */ case PRIV_KTRACE: + return (0); /* * Allow jailed processes to configure audit identity and