Change Details

Adds a `P_PROCDESC` idtype naming the target by a process descriptor the caller holds rather than by a pid, so process control stays available in capability mode -- procctl(2) becomes `CAPENABLED`, and in capability mode `P_PROCDESC` is the only identifier accepted. Guarded by a new `CAP_PROCCTL` right. This follows the direction of D58586, which reaches ptrace(2) operations through a process descriptor rather than adding parallel syscalls. Using the existing multiplexer keeps the ABI addition to one idtype instead of one syscall per operation, and it happens to be the natural fit for an embryonic process: pdnew(2) yields a descriptor and no pid the caller should have to use. posix_spawn(3) uses it for `POSIX_SPAWN_DISABLE_ASLR_NP`, which is already a `procctl(PROC_ASLR_CTL)` and so needs no new command, removing that attribute from the set that still falls back to vfork(2). `P_PID` and `P_PROCDESC` both name exactly one process, so the common tail -- permission check, then run the command, then unlock -- is factored out into `kern_procctl_found()`. Depends on D58586 Assisted-by: Claude Code (Claude Opus 5)

Adds a `P_PROCDESC` idtype naming the target by a process descriptor the caller holds rather than by a pid, so process control stays available in capability mode -- procctl(2) becomes `CAPENABLED`, and in capability mode `P_PROCDESC` is the only identifier accepted. Guarded by a new `CAP_PROCCTL` right. This follows the direction of D58586, which reaches ptrace(2) operations through a process descriptor rather than adding parallel syscalls. Using the existing multiplexer keeps the ABI addition to one idtype instead of one syscall per operation, and it happens to be the natural fit for an embryonic process: pdnew(2) yields a descriptor and no pid the caller should have to use. posix_spawn(3) uses it for `POSIX_SPAWN_DISABLE_ASLR_NP`, which is already a `procctl(PROC_ASLR_CTL)` and so needs no new command, removing that attribute from the set that still falls back to vfork(2). `P_PID` and `P_PROCDESC` both name exactly one process, so the common tail -- permission check, then run the command, then unlock -- is factored out into `kern_procctl_found()`. Assisted-by: Claude Code (Claude Opus 5)

Adds a `P_PROCDESC` idtype naming the target by a process descriptor the caller holds rather than by a pid, so process control stays available in capability mode -- procctl(2) becomes `CAPENABLED`, and in capability mode `P_PROCDESC` is the only identifier accepted. Guarded by a new `CAP_PROCCTL` right. This follows the direction of D58586, which reaches ptrace(2) operations through a process descriptor rather than adding parallel syscalls. Using the existing multiplexer keeps the ABI addition to one idtype instead of one syscall per operation, and it happens to be the natural fit for an embryonic process: pdnew(2) yields a descriptor and no pid the caller should have to use. posix_spawn(3) uses it for `POSIX_SPAWN_DISABLE_ASLR_NP`, which is already a `procctl(PROC_ASLR_CTL)` and so needs no new command, removing that attribute from the set that still falls back to vfork(2). `P_PID` and `P_PROCDESC` both name exactly one process, so the common tail -- permission check, then run the command, then unlock -- is factored out into `kern_procctl_found()`. Depends on D58586 Assisted-by: Claude Code (Claude Opus 5)