From nobody Tue Jun 30 17:21:32 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLP3CM8z6jYZG for ; Tue, 30 Jun 2026 17:21:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLN5y4Gz3s2g for ; Tue, 30 Jun 2026 17:21:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nFmEbI+DDxV9zfxH1IzQpgU8syHAB22/xicQM1en5II=; b=nOOzvm/2KssA7PRpdOdx8FkeWMDIQwadF8P/zsrLJI+2t5h+fapmWg8jzO9qMJhIkgKk2G rKElT5qVvgusb+nNNmt885i82hvzMbfup0eDUtYdBOmLX5vX9XARuHxOAU5OA7C3+1IytM JIxnoUw8CMyS+WtCd/Q1Z4qMVV33S1r9ufjKn8vDLJsBuVkuT1k+dUqMjhNFuFNuF+A9P4 RuvijndWogn43xR2Ig9WE68+l7RHZmI8ikWNc1kI4pXUGL8bTHjeKNxs7/GAwWku1xV0Ts nCFzQEgX+C0gT2bnTAk/6x5gT+/lX2R+zt4y5oER+4RO7TQkscAnovoY0YGOMw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840092; a=rsa-sha256; cv=none; b=hv8SfYzpzMIrz1hSI05FNMKiao2SYTP8t3kr/Nqq+0bwk6JNx1nztXa8lDg0RQeb8zXmYN B6u9aavj833Y59ZRhe60H4cUEyfd6KH9A141kNop/mgehXhvlS1H6dkNOfZwe13OVbkQzP hUzQeXI5ssmgNGdGEoZCUcUGjPEiHkg92zlSe5XTaVj2VETXqnmIpGtiWFcFtuqQ1eknFe +IF5O9ngy2y4qx4wEJxNOtOF299yFCchmvYjKULr60GOQ7IQpXDnl948mU2DNf4DtiyNUo s3FRzSeXxXcB6o2deIZA1l0l9BwD4DeAcdKZSM04iu786hAZ2XgQ3GehM7kdmA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nFmEbI+DDxV9zfxH1IzQpgU8syHAB22/xicQM1en5II=; b=Ob2vbWLm5wPKxaM6GpervaKtL6bdXCPmQFrMf3A0059/NJN6GHvqfff9do7YD6d4S/d3Mi VBB5NrWxx3u57BwtCYJbaPqCycd5eCNojaiqDn1MBYsCDGszcLqXPXzWP3xhPxpMCfatJi assjlsJqRT2YlSL30+pG6FELWs8HqogDbPYK+IjHgWA/wu0Os+6rDFd6aDOVWvN74TudTf NDr9BCFDL2zT97mwU40JhkU4U2+smNQ0GJLDKEDRTp5MQdTE1rKNNoFG9SsqY9NY9amkyr E12bPD7gdkAxP+JyKwgJ+ZooqEkeqHVpudxTuLGIP0ZVFRABuiSUKXxN9LZfHw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLN4zf4ztFB for ; Tue, 30 Jun 2026 17:21:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4475d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: f887a2c04c9e - releng/15.0 - kern: fix auditing of ptrace(2) syscall requests List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: f887a2c04c9ec09c468f6bb0dd510588bf5b1225 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:32 +0000 Message-Id: <6a43fb1c.4475d.65bbb684@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f887a2c04c9ec09c468f6bb0dd510588bf5b1225 commit f887a2c04c9ec09c468f6bb0dd510588bf5b1225 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index 40da0a79b810..ac1dc00348c1 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2765,7 +2765,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); }