Index: sys/compat/linux/linux_misc.h =================================================================== --- sys/compat/linux/linux_misc.h +++ sys/compat/linux/linux_misc.h @@ -50,6 +50,8 @@ * Second arg is a ptr to return the * signal. */ +#define LINUX_PR_GET_DUMPABLE 3 +#define LINUX_PR_SET_DUMPABLE 4 #define LINUX_PR_GET_KEEPCAPS 7 /* Get drop capabilities on setuid */ #define LINUX_PR_SET_KEEPCAPS 8 /* Set drop capabilities on setuid */ #define LINUX_PR_SET_NAME 15 /* Set process name. */ @@ -57,6 +59,11 @@ #define LINUX_MAX_COMM_LEN 16 /* Maximum length of the process name. */ +/* For GET/SET DUMPABLE */ +#define LINUX_SUID_DUMP_DISABLE 0 /* Don't coredump setuid processes. */ +#define LINUX_SUID_DUMP_USER 1 /* Dump as user of process. */ +#define LINUX_SUID_DUMP_ROOT 2 /* Dump as root. */ + #define LINUX_MREMAP_MAYMOVE 1 #define LINUX_MREMAP_FIXED 2 Index: sys/compat/linux/linux_misc.c =================================================================== --- sys/compat/linux/linux_misc.c +++ sys/compat/linux/linux_misc.c @@ -1893,7 +1893,7 @@ int error = 0, max_size; struct proc *p = td->td_proc; char comm[LINUX_MAX_COMM_LEN]; - int pdeath_signal; + int pdeath_signal, trace_state; switch (args->option) { case LINUX_PR_SET_PDEATHSIG: @@ -1912,6 +1912,40 @@ (void *)(register_t)args->arg2, sizeof(pdeath_signal))); break; + /* + * As far as I can tell, in Linux these control two sort of unrelated + * policies: can set[gu]id processes dump, and who should own the + * resulting corefile? And processes that can not be dumped aldo can + * not be traced. In FreeBSD, we control the setuid dump + * enable/disable system-wide with 'sugid_coredump,' and tracability + * with P2_NOTRACE (PROC_TRACE_STATUS / PROC_TRACE_CTL_DISABLE). + * + * So, we proxy these knobs to the corresponding PROC_TRACE_* settings. + */ + case LINUX_PR_GET_DUMPABLE: + error = kern_procctl(td, P_PID, 0, PROC_TRACE_STATUS, + &trace_state); + if (error != 0) + return (error); + td->td_retval[0] = (trace_state != -1); + break; + case LINUX_PR_SET_DUMPABLE: + /* + * It is only valid for userspace to set one of these two + * flags, and only one at a time. + */ + switch (args->arg2) { + case LINUX_SUID_DUMP_DISABLE: + trace_state = PROC_TRACE_CTL_DISABLE_EXEC; + break; + case LINUX_SUID_DUMP_USER: + trace_state = PROC_TRACE_CTL_ENABLE; + break; + default: + return (EINVAL); + } + return (kern_procctl(td, P_PID, 0, PROC_TRACE_CTL, + &trace_state)); case LINUX_PR_GET_KEEPCAPS: /* * Indicate that we always clear the effective and