Change p_can{debug,see,sched,signal}()'s first argument to be a thread

pointer instead of a proc pointer and require the process pointed to
by the second argument to be locked.  We now use the thread ucred reference
for the credential checks in p_can*() as a result.  p_canfoo() should now
no longer need Giant.

8 files changed, 11 insertions, 9 deletions

diff --git a/sys/fs/procfs/procfs.c b/sys/fs/procfs/procfs.c
index 6d6162e..8083ba6 100644
--- a/sys/fs/procfs/procfs.c
+++ b/sys/fs/procfs/procfs.c
@@ -107,6 +107,7 @@ procfs_attr(PFS_ATTR_ARGS)
 		vap->va_mode = 0600;
 
 	/* p is locked by caller */
+	PROC_LOCK_ASSERT(p, MA_OWNED);
 	vap->va_uid = p->p_ucred->cr_uid;
 	vap->va_gid = p->p_ucred->cr_gid;
 	
@@ -130,8 +131,9 @@ procfs_notsystem(PFS_VIS_ARGS)
 int
 procfs_candebug(PFS_VIS_ARGS)
 {
+	PROC_LOCK_ASSERT(p, MA_OWNED);
 	return ((p->p_flag & P_SYSTEM) == 0 &&
-	    p_candebug(td->td_proc, p) == 0);
+	    p_candebug(td, p) == 0);
 }
 
 /*
diff --git a/sys/fs/procfs/procfs_ctl.c b/sys/fs/procfs/procfs_ctl.c
index cf8cbc7..0f35370 100644
--- a/sys/fs/procfs/procfs_ctl.c
+++ b/sys/fs/procfs/procfs_ctl.c
@@ -122,7 +122,7 @@ procfs_control(struct thread *td, struct proc *p, int op)
 	if (op == PROCFS_CTL_ATTACH) {
 		sx_xlock(&proctree_lock);
 		PROC_LOCK(p);
-		if ((error = p_candebug(td->td_proc, p)) != 0)
+		if ((error = p_candebug(td, p)) != 0)
 			goto out;
 		if (p->p_flag & P_TRACED) {
 			error = EBUSY;
@@ -165,7 +165,7 @@ out:
 	 */
 	PROC_LOCK(p);
 	if (op != PROCFS_CTL_DETACH &&
-	    ((error = p_candebug(td->td_proc, p)))) {
+	    ((error = p_candebug(td, p)))) {
 		PROC_UNLOCK(p);
 		return (error);
 	}
diff --git a/sys/fs/procfs/procfs_dbregs.c b/sys/fs/procfs/procfs_dbregs.c
index 29ff71b..361f34b 100644
--- a/sys/fs/procfs/procfs_dbregs.c
+++ b/sys/fs/procfs/procfs_dbregs.c
@@ -69,7 +69,7 @@ procfs_doprocdbregs(PFS_FILL_ARGS)
 	int kl;
 
 	PROC_LOCK(p);
-	if (p_candebug(td->td_proc, p) != 0) {
+	if (p_candebug(td, p) != 0) {
 		PROC_UNLOCK(p);
 		return (EPERM);
 	}
diff --git a/sys/fs/procfs/procfs_fpregs.c b/sys/fs/procfs/procfs_fpregs.c
index caabe49..afabb33 100644
--- a/sys/fs/procfs/procfs_fpregs.c
+++ b/sys/fs/procfs/procfs_fpregs.c
@@ -63,7 +63,7 @@ procfs_doprocfpregs(PFS_FILL_ARGS)
 	int kl;
 
 	PROC_LOCK(p);
-	if (p_candebug(td->td_proc, p)) {
+	if (p_candebug(td, p)) {
 		PROC_UNLOCK(p);
 		return (EPERM);
 	}
diff --git a/sys/fs/procfs/procfs_mem.c b/sys/fs/procfs/procfs_mem.c
index 1f92373..5c086be 100644
--- a/sys/fs/procfs/procfs_mem.c
+++ b/sys/fs/procfs/procfs_mem.c
@@ -66,7 +66,7 @@ procfs_doprocmem(PFS_FILL_ARGS)
 		return (0);
 
 	PROC_LOCK(p);
-	error = p_candebug(td->td_proc, p);
+	error = p_candebug(td, p);
 	PROC_UNLOCK(p);
 	if (error == 0)
 		error = proc_rwmem(p, uio);
diff --git a/sys/fs/procfs/procfs_regs.c b/sys/fs/procfs/procfs_regs.c
index 3c0a700..5fcb450 100644
--- a/sys/fs/procfs/procfs_regs.c
+++ b/sys/fs/procfs/procfs_regs.c
@@ -63,7 +63,7 @@ procfs_doprocregs(PFS_FILL_ARGS)
 	int kl;
 
 	PROC_LOCK(p);
-	if (p_candebug(td->td_proc, p)) {
+	if (p_candebug(td, p)) {
 		PROC_UNLOCK(p);
 		return (EPERM);
 	}
diff --git a/sys/fs/procfs/procfs_status.c b/sys/fs/procfs/procfs_status.c
index b03f4dc..6e5711b 100644
--- a/sys/fs/procfs/procfs_status.c
+++ b/sys/fs/procfs/procfs_status.c
@@ -182,7 +182,7 @@ procfs_doproccmdline(PFS_FILL_ARGS)
 	 */
 
 	PROC_LOCK(p);
-	if (p->p_args && (ps_argsopen || !p_cansee(td->td_proc, p))) {
+	if (p->p_args && (ps_argsopen || !p_cansee(td, p))) {
 		sbuf_bcpy(sb, p->p_args->ar_args, p->p_args->ar_length);
 		PROC_UNLOCK(p);
 		return (0);
diff --git a/sys/fs/pseudofs/pseudofs_vnops.c b/sys/fs/pseudofs/pseudofs_vnops.c
index e1541f9..ac49ca0 100644
--- a/sys/fs/pseudofs/pseudofs_vnops.c
+++ b/sys/fs/pseudofs/pseudofs_vnops.c
@@ -86,7 +86,7 @@ pfs_visible(struct thread *td, struct pfs_node *pn, pid_t pid)
 	if (pid != NO_PID) {
 		if ((proc = pfind(pid)) == NULL)
 			PFS_RETURN (0);
-		if (p_cansee(td->td_proc, proc) != 0 ||
+		if (p_cansee(td, proc) != 0 ||
 		    (pn->pn_vis != NULL && !(pn->pn_vis)(td, proc, pn)))
 			r = 0;
 		PROC_UNLOCK(proc);