Re: PR 291981: authpf under netlink, and a pfctl adoption flag

On 25 Jul 2026, at 18:10, Kristof Provost wrote:
> Let me think about this for a bit. We may have to go down the horrible path anyway, or perhaps we can not drop root privs, but instead limit the child process through capsicum. Or perhaps there’s a MAC module way to do this. I know Kyle has in-progress work that may allow us to give non-root processes access to pf’s netlink interface.
>
I rather wish I knew more about capsicum right now.

From the examples I’ve looked at so far it doesn’t look trivial. I’m pretty sure we can usefully restrict a child process, but we’d still have to have access to the relevant file(s), and those files might include other files, so that becomes a bit annoying.

I wondered about an alternative approach where we create a libcasper service for pf access, but that seems to not contemplate the scenario of a child process exec()-ing something else.

The least-bad answer here might be to wait for that mac module to land.

—
Kristof