Change Details

Adds a `P_PROCDESC` idtype naming the target by a process descriptor the caller holds rather than by a pid, so process control stays available in capability mode -- procctl(2) becomes `CAPENABLED`, and in capability mode `P_PROCDESC` is the only identifier accepted. Guarded by a new `CAP_PROCCTL` right. This follows the direction of D58586, which reaches ptrace(2) operations through a process descriptor rather than adding parallel syscalls. Using the existing multiplexer keeps the ABI addition to one idtype instead of one syscall per operation, and it happens to be the natural fit for an embryonic process: pdnew(2) yields a descriptor and no pid the caller should have to use. posix_spawn(3) uses it for `POSIX_SPAWN_DISABLE_ASLR_NP`, which is already a `procctl(PROC_ASLR_CTL)` and so needs no new command, removing that attribute from the set that still falls back to vfork(2). `P_PID` and `P_PROCDESC` both name exactly one process, so the common tail -- permission check, then run the command, then unlock -- is factored out into `kern_procctl_found()`. Assisted-by: Claude Code (Claude Opus 5)

Adds a `P_PROCDESC` idtype naming the target by a process descriptor the caller holds rather than by a pid, so process control stays available in capability mode -- procctl(2) becomes `CAPENABLED`, and in capability mode `P_PROCDESC` is the only identifier accepted. Guarded by a new `CAP_PROCCTL` right, which is not granted on the output of pdfork(2) by default; a caller opts in with the `PD_PROCCTL_CAP` flag. This follows the direction of D58586, which reaches ptrace(2) operations through a process descriptor rather than adding parallel syscalls. It likewise made `CAP_PTRACE` not granted by default, too. Using the existing multiplexer keeps the ABI addition to one idtype instead of one syscall per operation, and it happens to be the natural fit for an embryonic process: pdnew(2) yields a descriptor and no pid the caller should have to use. posix_spawn(3) uses it for `POSIX_SPAWN_DISABLE_ASLR_NP`, which is already a `procctl(PROC_ASLR_CTL)` and so needs no new command, removing that attribute from the set that still falls back to vfork(2). A tiny `kern_procctl_permit()` is also factored out to make sure that this one liner --- which now would have occured in three, not two places, otherwise --- doesn't drift out of sync. Depends on D58586 Assisted-by: Claude Code (Claude Opus 5)

Adds a `P_PROCDESC` idtype naming the target by a process descriptor the caller holds rather than by a pid, so process control stays available in capability mode -- procctl(2) becomes `CAPENABLED`, and in capability mode `P_PROCDESC` is the only identifier accepted. Guarded by a new `CAP_PROCCTL` right, which is not granted on the output of pdfork(2) by default; a caller opts in with the `PD_PROCCTL_CAP` flag. This follows the direction of D58586, which reaches ptrace(2) operations through a process descriptor rather than adding parallel syscalls. It Using the existing multiplexer keeps the ABI addition to one idtypelikewise made `CAP_PTRACE` not granted by default, too. Using the instead of one syscall per operation, and it happensexisting multiplexer keeps the ABI addition to be the naturalone idtype instead of one fit for an embryonic process: pdnew(2) yields a descriptor and no pidsyscall per operation, and it happens to be the natural fit for an embryonic process: pdnew(2) yields a descriptor and no pid the caller should have to use. posix_spawn(3) uses it for `POSIX_SPAWN_DISABLE_ASLR_NP`, which is already a `procctl(PROC_ASLR_CTL)` and so needs no new command, removing that attribute from the set that still falls back to vfork(2). `P_PID` and `P_PROCDESC` both name exactly one process, so the commonA tiny `kern_procctl_permit()` is also factored out to make sure that tail -- permission check, then run the commandthis one liner --- which now would have occured in three, then unlock -- isnot two factored out into `kern_procctl_found()`.places, otherwise --- doesn't drift out of sync. Depends on D58586 Assisted-by: Claude Code (Claude Opus 5)