From 72e34b3e3907d5fd63abf7b2246cae80641769b3 Mon Sep 17 00:00:00 2001
From: Ed Maste <emaste@FreeBSD.org>
Date: Fri, 29 May 2026 16:48:34 -0400
Subject: [PATCH] get/setpriority: Add capability mode checks

Reviewed by: oshogbo
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57345
---
 sys/kern/kern_resource.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
index 31f89bd41f6d..95c4e7d5eead 100644
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -37,6 +37,7 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
+#include <sys/capsicum.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
 #include <sys/kernel.h>
@@ -99,6 +100,13 @@ kern_getpriority(struct thread *td, int which, int who)
 	struct pgrp *pg;
 	int error, low;
 
+	if (IN_CAPABILITY_MODE(td)) {
+		if (which != PRIO_PROCESS)
+			return (ECAPMODE);
+		if (who != 0 && who != td->td_proc->p_pid)
+			return (ECAPMODE);
+	}
+
 	error = 0;
 	low = PRIO_MAX + 1;
 	switch (which) {
@@ -189,6 +197,14 @@ kern_setpriority(struct thread *td, int which, int who, int prio)
 	int found = 0, error = 0;
 
 	curp = td->td_proc;
+
+	if (IN_CAPABILITY_MODE(td)) {
+		if (which != PRIO_PROCESS)
+			return (ECAPMODE);
+		if (who != 0 && who != curp->p_pid)
+			return (ECAPMODE);
+	}
+
 	switch (which) {
 	case PRIO_PROCESS:
 		if (who == 0) {