Paths

Table of Contentst

kevent: Disallow certain filter types in capability mode
Needs ReviewPublic
Actions

Authored by markj on Jul 22 2026, 3:48 PM.

Details

Reviewers

kib
kevans

Group Reviewers

capsicum

Summary

EVFILT_PROC, EVFILT_JAIL and EVFILT_FS knotes let a process collect
information about objects without requiring a capability. They
shouldn't be allowed when the process is in capability mode, so add
checks to this effect.

Note, this does nothing about knotes that are registered already at the
time cap_enter() is called, but I think this is acceptable.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 75017
Build 71900: arc lint + arc unit

Event Timeline

markj created this revision.Jul 22 2026, 3:48 PM

Herald added subscribers: olce, imp. · View Herald TranscriptJul 22 2026, 3:48 PM

markj requested review of this revision.Jul 22 2026, 3:48 PM

Harbormaster completed remote builds in B75017: Diff 182468.Jul 22 2026, 3:48 PM

This would prevent a process from tracking itself using EVFILT_PROC. Not sure how useful it is, but maybe it makes sense to add an exception for ident == getpid().

Same for EVFILT_JAIL.

In D58397#1339692, @arrowd wrote:

This would prevent a process from tracking itself using EVFILT_PROC. Not sure how useful it is, but maybe it makes sense to add an exception for ident == getpid().

Yes, there is some precedent for that. For instance, raise() is supposed to work in capability mode.

Same for EVFILT_JAIL.

Why? The current process doesn't own its containing jail in any sense.

In D58397#1339713, @markj wrote:

In D58397#1339692, @arrowd wrote:

This would prevent a process from tracking itself using EVFILT_PROC. Not sure how useful it is, but maybe it makes sense to add an exception for ident == getpid().

Yes, there is some precedent for that. For instance, raise() is supposed to work in capability mode.

But then what to do with NOTE_TRACK, without which EVFILT_PROC is useless. Esp. it is useless on itself.

sys/kern/kern_event.c
457	If we do not need much flexibility, it might be better to add a flag to filterops which would deny attach if in_cap_mode() && flag && !f_isfd.

In D58397#1339713, @markj wrote:

Same for EVFILT_JAIL.

Why? The current process doesn't own its containing jail in any sense.

Yes, you're correct, don't mind me.

In D58397#1339785, @kib wrote:

In D58397#1339713, @markj wrote:

In D58397#1339692, @arrowd wrote:

This would prevent a process from tracking itself using EVFILT_PROC. Not sure how useful it is, but maybe it makes sense to add an exception for ident == getpid().

Yes, there is some precedent for that. For instance, raise() is supposed to work in capability mode.

But then what to do with NOTE_TRACK, without which EVFILT_PROC is useless. Esp. it is useless on itself.

Yeah, it does not seem very useful. Without some use-case I am inclined to disallow all uses of EVFILT_PROC in capmode.

sys/kern/kern_event.c
457	If anything I would invert such a flag, so !f_isfd filters are disallowed in capmode unless they set the flag.

kib added inline comments.Jul 23 2026, 3:18 PM

sys/kern/kern_event.c
457	Sure., Technically, I think that f_isfd should become a flag word instead of bool.

Revision Contents
Changeset List

Path

Size

sys/

kern/

kern_event.c

6 lines

vfs_subr.c

2 lines

Diff 182468

View Options

sys/kern/kern_event.c