From nobody Tue Jun 30 17:19:15 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVHm1ynZz6jXdC for ; Tue, 30 Jun 2026 17:19:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVHl6JFtz3nMZ for ; Tue, 30 Jun 2026 17:19:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839955; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vzxnRsEFGJgqPEjFiKqD5JqCvWM7lU7prHQ4hflu6CA=; b=t6tgR824oF7Kjaswi9hnAScNPNgaKtKPuo49hB1/DoXS1g6vO4UL9VqZp/KaoaWQdGfosa 5mlJxH4L/EIG4ORYvHXqEJtdwgzMmkvAs6+ZXgN18NKjufqGrbOnEGVb2KFmcT3uHdE6Hi 4I0XM1MDPvl4BERIOFpCOgpf85F/5ikbGRyuvhPvu8yxzoq9cgDbPKlLiR06TI1ypgbl00 NvoURaNK5IzScn9HpUwF0CToRFtypClHJaR5kTKVsfG81+IjjaJlSRQCrxiiNqUAGLW4Pv wS7xTA4a2KA1w9d+jszhaaX8p1FFw1muSxphp+TY2a7spB67pq41eKTZAcaebA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839955; a=rsa-sha256; cv=none; b=TzvzxvRr7LYP6JvoUaX/b3VJaJaVhd4g7q+EQ2FWwpWBD9uOPmh3pSYaWl6lGrR8GSglrF h5Y//ofEfw+A+MsCsw+ECZCn/gSx1YZ5ORhT2gK3DmpSmTjLXeHuk2xCpCFicC0P+serZu 1N/hj059WKVWpf2s11bTfGxx1q58HbVw2vYcRo3i4+c8x+3NpajMHBE2rIumx+MOh+W0ZM 8SjkepeeaYE9+LpvxuwxiBqaJaK/J2tPTi8SS8ahPW983FpwO3jKFmpmmcre8bceOQW2s5 7OE3c1sD/bM1wW3bdx/fIWb0f0iMXNofrb16wtJ7cACc2tun8u+66yp6KAFwiA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839955; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vzxnRsEFGJgqPEjFiKqD5JqCvWM7lU7prHQ4hflu6CA=; b=Gl/TTILkLedjyQCkBHXQkAxgeCkci6RcxkmWHS6Fc1p70Bm7Zdx6dwd2I+Lth95ZPd0nLs lmGMRW3Vq+262ju+1R543J2DIe13mCn3m5VNJCpYVju3Se6Pq7tFeXiqE0Fl9fXke2F5MM agq/2rOF8XeEhjtXW5zjhbwjUQ1OolCs6ipjDaJ1ZE2c2UlMXVntsKTLPslwbSVHEnkSVs KhCyqMqUnpyWhXaTmClBe4r9bIU/PI+z9LDxeT6NXfLYBNXGzKJb9M+BKOEGUcZDewyaGR cysC2zLq2aSA/uS5zpSUloRgBStDK66VASLrLqbRPoMeMikZt5omh9NoxRnifw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVHl5G44ztTt for ; Tue, 30 Jun 2026 17:19:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4197c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:15 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: bcbbee810fc9 - main - kern: fix auditing of ptrace(2) syscall requests List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bcbbee810fc9733da27b31b23baeaa2e1af53232 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:15 +0000 Message-Id: <6a43fa93.4197c.52615c9b@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=bcbbee810fc9733da27b31b23baeaa2e1af53232 commit bcbbee810fc9733da27b31b23baeaa2e1af53232 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:23 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index e48997ed966a..fed5b62ee1c7 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2766,7 +2766,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); }