[Bug 296521] bin/pfctl: pf's netlink conversion blocks non-VNET jails from using pfctl (no allow.pf / RTNL_F_ALLOW_NONVNET_JAIL equivalent)
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 05 Jul 2026 10:12:10 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296521
Marek Zarychta <zarychtam@plan-b.pwste.edu.pl> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |net@FreeBSD.org
--- Comment #2 from Marek Zarychta <zarychtam@plan-b.pwste.edu.pl> ---
Perhaps this behaviour should be discussed on the freebsd-net@ mailing list.
Currently, non-VNET jails can be permitted to manipulate routing tables via the
security.jail.param.allow.routing setting. If modifying the FIB is considered
acceptable in a non-VNET jail under controlled circumstances, then perhaps
firewall management should be governed by a similar dedicated permission or
sysctl knob, rather than being treated as an all-or-nothing capability.
At the very least, it would be useful to clarify whether the current behaviour
is an intentional policy decision or an unintended regression.
--
You are receiving this mail because:
You are the assignee for the bug.