On Thu, Oct 15, 2020 at 6:42 PM Thomas Munro <thomas.munro@gmail.com> wrote:
> I tried to test this on my system but it seems like maybe FreeBSD
> can't really report EACCES for EVFILT_PROC. From the man page and a
> quick inspection of the source, you only have to be able to "see" the
> process, and if you can't I think you'll get ESRCH, so EACCES may be
> for other kinds of filters. I don't currently have any Apple gear to
> hand, but its man page uses the same language, but on the other hand I
> do see EACCES in filt_procattach() in the darwin-xnu sources on github
> so I guess you can reach this case and get an ugly ereport (hopefully
> followed swiftly by a proc_exit() from the next wait on one of the
> long lived WESs, or a FATAL if this was the creation of one of those).
I couldn't resist digging further into the Apple sources to figure out
what was going on there, and I realised that the code path I was
looking at can only report EACCES if you asked for NOTE_EXITSTATUS,
which appears to be an Apple extension to the original FreeBSD kqueue
system designed to let you receive the exit status of the monitored
process. That is indeed much more privileged information, and it's
only allowed for your own children. So it's possible that commit
70516a17 was a waste of electrons, but I don't think it can hurt;
either way, our system is toast if we get that error, so it's mostly
just a question of what sort of noises we make as we fail, if indeed
any system really can produce EACCES for NOTE_EXIT (maybe in some
other code path I haven't found, or some other cousin BSD).