[Bug 222632] Enable Capsicum for connect(2)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222632

Domagoj Stolfa <domagoj.stolfa at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |domagoj.stolfa at gmail.com

--- Comment #8 from Domagoj Stolfa <domagoj.stolfa at gmail.com> ---
I've not investigated this too much, but I can see why in some sense,
connect(2) could be seen as gaining an additional capability and could have
issues. The connectat(2) system call is the one that works with PF_LOCAL
sockets, so you could use that instead for a Unix socket.

There does seem to be a discrepancy across the documentation and what is
actually implemented, as CAP_CONNECT explicitly states that connect(2) is
allowed and the check is in place in the actual implementation, but connect is
not present in sys/kern/capabilities.conf, resulting in ECAPMODE.

-- 
You are receiving this mail because:
You are the assignee for the bug.