git: ffad04235a76 - stable/15 - syslogd: Limit rights on procdescs

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=ffad04235a767852aaac3f1fce673a9c78c2753b

commit ffad04235a767852aaac3f1fce673a9c78c2753b
Author:     Mark Johnston <[email protected]>
AuthorDate: 2026-07-10 20:25:54 +0000
Commit:     Mark Johnston <[email protected]>
CommitDate: 2026-08-06 12:52:28 +0000

    syslogd: Limit rights on procdescs
    
    Reviewed by:    jfree, kib
    MFC after:      3 weeks
    Differential Revision:  https://reviews.freebsd.org/D58160
    
    (cherry picked from commit 24816abb8740c387ad4aba4ad2fa4c23b191c351)
---
 usr.sbin/syslogd/syslogd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
index 981428dbb8eb..8aed89e5dc36 100644
--- a/usr.sbin/syslogd/syslogd.c
+++ b/usr.sbin/syslogd/syslogd.c
@@ -3770,6 +3770,7 @@ validate(struct sockaddr *sa, const char *hname)
 int
 p_open(const char *prog, int *rpd)
 {
+	cap_rights_t rights;
 	struct sigaction act = { };
 	int pfd[2], pd;
 	pid_t pid;
@@ -3821,6 +3822,10 @@ p_open(const char *prog, int *rpd)
 		dprintf("Warning: cannot change pipe to PID %d to non-blocking"
 		    "behaviour.", pid);
 	}
+
+	if (cap_rights_limit(pd,
+	    cap_rights_init(&rights, CAP_PDKILL, CAP_EVENT)) == -1)
+		err(1, "cap_rights_limit");
 	*rpd = pd;
 	return (pfd[1]);
 }