[Midnightbsd-cvs] [MidnightBSD/src] 09e789: capsicum: restrict sigqueue in capability mode

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 09e789e32e05cec4bfe78822a8b0b397c05169d6
      https://github.com/MidnightBSD/src/commit/09e789e32e05cec4bfe78822a8b0b397c05169d6
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-10 (Wed, 10 Jun 2026)

  Changed paths:
    M contrib/capsicum-test/capmode.cc
    M sys/kern/kern_sig.c

  Log Message:
  -----------
  capsicum: restrict sigqueue in capability mode

A process in capability mode should only be able to signal itself through sigqueue(2), matching the existing kill(2) restriction.  Reject attempts to target other PIDs with ECAPMODE before normal signal permission checks.

Add regression coverage to the Capsicum SelfKill test so sigqueue(2) is checked alongside kill(2).

CVE-2026-45259

AI-Assisted-by: Codex (GPT-5)
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: b30c0e6d678c5cf4b5f210def7bef3247ce8d12f
      https://github.com/MidnightBSD/src/commit/b30c0e6d678c5cf4b5f210def7bef3247ce8d12f
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-10 (Wed, 10 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: note capsicum sigqueue fix

Record the CVE-2026-45259 capability mode restriction for sigqueue(2).

AI-Assisted-by: Codex (GPT-5)
Signed-off-by: Lucas Holt <luke at foolishgames.com>


Compare: https://github.com/MidnightBSD/src/compare/8f0fd3c11515...b30c0e6d678c

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications