1.\" Copyright (c) 2019 The FreeBSD Foundation, Inc. 2.\" 3.\" This documentation was written by 4.\" Konstantin Belousov <kib@FreeBSD.org> under sponsorship 5.\" from the FreeBSD Foundation. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd October 5, 2023 29.Dt PROCCONTROL 1 30.Os 31.Sh NAME 32.Nm proccontrol 33.Nd Control some process execution aspects 34.Sh SYNOPSIS 35.Nm 36.Fl m Ar mode 37.Op Fl s Ar control 38.Op Fl q 39.Fl p Ar pid | command 40.Sh DESCRIPTION 41The 42.Nm 43command modifies the execution parameter of existing process 44specified by the 45.Ar pid 46argument, or starts execution of the new program 47.Ar command 48with the execution parameter set for it. 49.Pp 50Which execution parameter is changed, selected by the mandatory 51parameter 52.Ar mode . 53Possible values for 54.Ar mode 55are: 56.Bl -tag -width trapcap 57.It Ar aslr 58Control the Address Space Layout Randomization. 59Only applicable to the new process spawned. 60.It Ar trace 61Control the permission for debuggers to attach. 62Note that process is only allowed to enable tracing for itself, 63not for any other process. 64.It Ar trapcap 65Controls the signalling of capability mode access violations. 66.It Ar protmax 67Controls the implicit PROT_MAX application for 68.Xr mmap 2 . 69.It Ar nonewprivs 70Controls disabling the setuid and sgid bits for 71.Xr execve 2 . 72.It Ar wxmap 73Controls the write exclusive execute mode for mappings. 74.It Ar kpti 75Controls the KPTI enable, AMD64 only. 76.It Ar la48 77Control limiting usermode process address space to 48 bits of address, 78AMD64 only, on machines capable of 57-bit addressing. 79.El 80.Pp 81The 82.Ar control 83specifies if the selected 84.Ar mode 85should be enabled or disabled. 86Possible values are 87.Ar enable 88and 89.Ar disable , 90with the default value being 91.Ar enable 92if not specified. 93See 94.Xr procctl 2 95for detailed description of each mode effects and interaction with other 96process control facilities. 97.Pp 98The 99.Fl q 100switch makes the utility query and print the current setting for 101the selected mode. 102The 103.Fl q 104requires the query target process specification with 105.Fl p . 106.Sh EXIT STATUS 107.Ex -std 108.Sh EXAMPLES 109.Bl -bullet 110.It 111To disable debuggers attachment to the process 1020, execute 112.Dl "proccontrol -m trace -s disable -p 1020" 113.It 114To execute the 115.Xr uniq 1 116program in a mode where capability access violations cause 117.Dv SIGTRAP 118delivery, do 119.Dl "proccontrol -m trapcap uniq" 120.It 121To query the current ASLR enablement mode for the running 122process 1020, do 123.Dl "proccontrol -m aslr -q -p 1020" 124.El 125.Sh SEE ALSO 126.Xr kill 2 , 127.Xr procctl 2 , 128.Xr ptrace 2 , 129.Xr mitigations 7 130.Sh HISTORY 131The 132.Nm 133command appeared in 134.Fx 10.0 . 135.Sh AUTHORS 136The 137.Nm 138command and this manual page were written by 139.An Konstantin Belousov Aq Mt kib@freebsd.org 140under sponsorship from The FreeBSD Foundation. 141