Date: Wed, 29 Jul 2026 17:48:42 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Alexander Leidinger <netchild@FreeBSD.org> Subject: git: fb432f55a7b8 - stable/15 - jail: restore ktrace privileges for jailed root Message-ID: <6a6a3cfa.3aba6.5dc14d73@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=fb432f55a7b8bfcdc1ec4a24b1c861f15b867da5 commit fb432f55a7b8bfcdc1ec4a24b1c861f15b867da5 Author: Alexander Leidinger <netchild@FreeBSD.org> AuthorDate: 2026-07-17 21:33:00 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-07-29 17:48:13 +0000 jail: restore ktrace privileges for jailed root Commit 4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail") removed the #if 0 around the audit cases in prison_priv_check() and added the PR_ALLOW_SETAUDIT check under them. This unintentionally captured the preceding case PRIV_KTRACE, which used to fall through the disabled block into the unconditional return (0) of the credential cases: since then, jailed root only has ktrace privileges (tracing processes with changed credentials, see ktrcanset()) when the unrelated allow.setaudit knob is enabled, and conversely gains them when that audit knob is turned on. Give PRIV_KTRACE back its own unconditional return (0), matching its comment and the pre-4be491e1b9b3 behaviour. Approved by: so Security: FreeBSD-SA-26:53.ktrace Security: CVE-2026-58086 Fixes: 4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail") Reviewed by: markj Assisted-by: Claude Code (Fable 5) --- sys/kern/kern_jail.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 6b0ae8fbb8ce..ab91b35dae81 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -4378,6 +4378,7 @@ prison_priv_check(struct ucred *cred, int priv) * Allow ktrace privileges for root in jail. */ case PRIV_KTRACE: + return (0); /* * Allow jailed processes to configure audit identity andhome | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a6a3cfa.3aba6.5dc14d73>