o Add a comment to p_candebug() noting that the P_INEXEC check should

  really be moved elsewhere: p_candebug() encapsulates the security
  policy decision, whereas the P_INEXEC check has to do with "correctness"
  regarding race conditions, rather than security policy.

  Example: even if no security protections were enforced (the "uids are
  advisory" model), removing P_INEXEC could result in incorrect operation
  due to races on credential evaluation and modification during execve().

Obtained from:	TrustedBSD Project

1 files changed, 6 insertions, 1 deletions

diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index 6a17898..f98135a 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -1569,7 +1569,12 @@ p_candebug(struct proc *p1, struct proc *p2)
 			return (error);
 	}
 
-	/* can't trace a process that's currently exec'ing */
+	/*
+	 * Can't trace a process that's currently exec'ing.
+	 * XXX: Note, this is not a security policy decision, it's a
+	 * basic correctness/functionality decision.  Therefore, this check
+	 * should be moved to the caller's of p_candebug().
+	 */
 	if ((p2->p_flag & P_INEXEC) != 0)
 		return (EAGAIN);