From nobody Fri Oct 30 14:08:09 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGNGy5tw3z6wwZg for ; Fri, 30 Oct 2026 14:08:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGNGy1KH8z4qds for ; Fri, 30 Oct 2026 14:08:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793369290; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jIZ0O5y4gJxgKQTtJnIDgCnavTT4NrtxfD3NcnPddxI=; b=BzFv+zW1eMnbGrSY50dteAiM0P+BlUGICuF2A3ECQiquVIo9II0+G4w8boYgPeLTXR6SS5 TqyHwDPT7MesBUyWJTX+eeuWo7XPRqguPq05JVoqI0iXAjdQlQuEJaGPw1rjFEpXyVdyPv Lm1jifWDBOrxuJsfiDqHR2ey9V909hAVeqPYYA3sh9pQLLlI4LFhOisyuXxKaf4yQp+QSD x9SZ792/LNTSbfBuAjFroPeCxr8xaHKwe29lIePnnFDoTlHGyavUR+Mfj1oE86AUPuOy7+ YMkur87fE+t+hYiJE9rGt3DZPCBi7eWiuZFrl3ADPqmCWBkAvhKRIQNTSeSL2g== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793369290; b=QOBDDDxpDOQU4G6dlv/tORhevBChzlPl+Kwp3lowIK0Bx37rfsNwPm/kT800NQNpIJ4uku 1R2oq85o3FiIO+gOrTvxlisFQSx6KRA1y3W/R3VbesW+p7/zYgZSv3tTCeok2F++xSvd0K MigKaVe45V+EzLKjJtg6HeRMDXXwhTKexz7IiM3YIg1cydWiRIWtkDdOFrSsvCVb0PkrS8 1RUi7XJS1N8gtShbIWNjOuDAaXv1G5rUKs4MpiMbn9smsCEmKg2XaLk9JcUgTt3wDBSJZ6 rMVPePHLmyXkP1MP+rwViy/Tng7RLruJAtGQf7/x+HiUgDbr8Gyf/8BgRwel4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793369290; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jIZ0O5y4gJxgKQTtJnIDgCnavTT4NrtxfD3NcnPddxI=; b=tq6iLOSUfOz0hODFXBALFVbTxw0vQ/1uja6rIYajkFS7tq9VKtayXwYDmZ9UXPbiVpYidM IzsED/oJSuIMtB/lQslE2cT0HZ/Cpiq+y6gH4nrfd8+9lvGeRJK6UmWkET6EffcbARoyy1 PrzXZoQRfOPjaYUs2UZgNytMpp/C5IDwY0Rqg9aab3mK6jexvKLvS1euQ9V237qmoIuxt+ m8EwNDGG+zxtFVkdkVISNfq6TeR9MEwfgfWYGqHQp/CaK1ky2UoolYoplYy9YdpwWL3nkZ G/C8xy0YloV+K0OYH6FSrp0yWsU1U4/7NamToy8VRaJdrhlVB7+/D/s7fAUsWg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGNGx6g3dzV9Z for ; Fri, 30 Oct 2026 14:08:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22715 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 14:08:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Avinash Duduskar From: Kristof Provost Subject: git: 674932048a15 - main - authpf: pass the privileged Netlink socket to pfctl List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 674932048a15203b9f45242be17b2ea10feb0d02 Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 14:08:09 +0000 Message-Id: <6ae4a4c9.22715.29ab7adb@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=674932048a15203b9f45242be17b2ea10feb0d02 commit 674932048a15203b9f45242be17b2ea10feb0d02 Author: Avinash Duduskar AuthorDate: 2026-10-26 14:38:11 +0000 Commit: Kristof Provost CommitDate: 2026-10-30 14:07:10 +0000 authpf: pass the privileged Netlink socket to pfctl authpf opens its pf handle as root and drops privileges before it runs pfctl to load the per-user ruleset. The child inherits the /dev/pf descriptor through -p /dev/fd/N, but since pf's control path moved to Netlink, pfctl opens a Netlink socket of its own, which carries the unprivileged credentials, and the first privileged command on it fails: every authpf login ends with "pfctl exited abnormally" on 15.x. Pass the socket authpf already holds with the new -l flag, next to the device. Clear FD_CLOEXEC on both descriptors before the exec so the handoff does not depend on how libpfctl happened to open them. The socket already reached the child: neither libpfctl nor snl opens its descriptors close-on-exec and authpf closes nothing before the exec, so since pf moved to Netlink the unprivileged pfctl has inherited it unused. Passing its number makes the handoff deliberate. The socket carries root's credentials for every generic Netlink family, so the child could reach pflow, carp and the kernel RPC family through it, not only pf; it already had full control of pf through /dev/pf. PR: 291981 Signed-off-by: Avinash Duduskar Reviewed by: kp Pull Request: https://github.com/freebsd/freebsd-src/pull/2508 --- contrib/pf/authpf/authpf.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/contrib/pf/authpf/authpf.c b/contrib/pf/authpf/authpf.c index b835737c5ee2..35e3a865bd51 100644 --- a/contrib/pf/authpf/authpf.c +++ b/contrib/pf/authpf/authpf.c @@ -748,16 +748,17 @@ static int change_filter(int add, const char *l_user, const char *ip_src) { char *fdpath = NULL, *userstr = NULL, *ipstr = NULL; - char *rsn = NULL, *fn = NULL; + char *rsn = NULL, *fn = NULL, *nlfdstr = NULL; pid_t pid; gid_t gid; int s; if (add) { struct stat sb; - char *pargv[13] = { - "pfctl", "-p", "/dev/pf", "-q", "-a", "anchor/ruleset", - "-D", "user_id=X", "-D", "user_ip=X", "-f", "file", NULL + char *pargv[15] = { + "pfctl", "-p", "/dev/pf", "-l", "nlfd", "-q", "-a", + "anchor/ruleset", "-D", "user_id=X", "-D", "user_ip=X", + "-f", "file", NULL }; if (l_user == NULL || !l_user[0] || ip_src == NULL || !ip_src[0]) { @@ -769,6 +770,8 @@ change_filter(int add, const char *l_user, const char *ip_src) goto no_mem; if (asprintf(&fdpath, "/dev/fd/%d", pfctl_fd(pfh)) == -1) goto no_mem; + if (asprintf(&nlfdstr, "%d", pfctl_nl_fd(pfh)) == -1) + goto no_mem; if (asprintf(&ipstr, "user_ip=%s", ip_src) == -1) goto no_mem; if (asprintf(&userstr, "user_id=%s", l_user) == -1) @@ -782,15 +785,16 @@ change_filter(int add, const char *l_user, const char *ip_src) goto no_mem; } pargv[2] = fdpath; - pargv[5] = rsn; - pargv[7] = userstr; + pargv[4] = nlfdstr; + pargv[7] = rsn; + pargv[9] = userstr; if (user_ip) { - pargv[9] = ipstr; - pargv[11] = fn; + pargv[11] = ipstr; + pargv[13] = fn; } else { - pargv[8] = "-f"; - pargv[9] = fn; - pargv[10] = NULL; + pargv[10] = "-f"; + pargv[11] = fn; + pargv[12] = NULL; } switch (pid = fork()) { @@ -803,6 +807,14 @@ change_filter(int add, const char *l_user, const char *ip_src) if (setregid(gid, gid) == -1) { err(1, "setregid"); } + /* + * pfctl inherits both descriptors; do not rely on how + * libpfctl happened to open them. + */ + if (fcntl(pfctl_fd(pfh), F_SETFD, 0) == -1 || + fcntl(pfctl_nl_fd(pfh), F_SETFD, 0) == -1) { + err(1, "fcntl"); + } execvp(PATH_PFCTL, pargv); warn("exec of %s failed", PATH_PFCTL); _exit(1); @@ -829,6 +841,7 @@ no_mem: syslog(LOG_ERR, "malloc failed"); error: free(fdpath); + free(nlfdstr); free(rsn); free(userstr); free(ipstr);