[Midnightbsd-cvs] [MidnightBSD/src] 06203c: capsicum: restrict sigqueue in capability mode

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 06203c9d746e57f8e120a34c090d37ced2952cdf
      https://github.com/MidnightBSD/src/commit/06203c9d746e57f8e120a34c090d37ced2952cdf
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-10 (Wed, 10 Jun 2026)

  Changed paths:
    M contrib/capsicum-test/capmode.cc
    M sys/kern/kern_sig.c

  Log Message:
  -----------
  capsicum: restrict sigqueue in capability mode

A process in capability mode should only be able to signal itself through sigqueue(2), matching the existing kill(2) restriction.  Reject attempts to target other PIDs with ECAPMODE before normal signal permission checks.

Add regression coverage to the Capsicum SelfKill test so sigqueue(2) is checked alongside kill(2).

CVE-2026-45259

AI-Assisted-by: Codex (GPT-5)
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications