Adds a P_PROCDESC idtype naming the target by a process descriptor the
caller holds rather than by a pid, so process control stays available in
capability mode -- procctl(2) becomes CAPENABLED, and in capability
mode P_PROCDESC is the only identifier accepted. Guarded by a new
CAP_PROCCTL right.
This follows the direction of D58586, which reaches ptrace(2) operations
through a process descriptor rather than adding parallel syscalls.
Using the existing multiplexer keeps the ABI addition to one idtype
instead of one syscall per operation, and it happens to be the natural
fit for an embryonic process: pdnew(2) yields a descriptor and no pid
the caller should have to use.
posix_spawn(3) uses it for POSIX_SPAWN_DISABLE_ASLR_NP, which is
already a procctl(PROC_ASLR_CTL) and so needs no new command, removing
that attribute from the set that still falls back to vfork(2).
P_PID and P_PROCDESC both name exactly one process, so the common
tail -- permission check, then run the command, then unlock -- is
factored out into kern_procctl_found().
Assisted-by: Claude Code (Claude Opus 5)