[Bug 222632] Enable Capsicum for connect(2)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222632

--- Comment #10 from Shawn Webb <shawn.webb at hardenedbsd.org> ---
It turns out that SSL_connect doesn't call connect(2). SSL_connect assumes an
already-connected socket. Its job is to set up the SSL/TLS side of things.
Which is really good news.

I'm able to tell the non-capmode child process to perform the connect on behalf
of the capmode parent. This is a doable workaround. However, long-term, we
should figure out how to be able to call connect(2) in capmode. Until then, we
should explicitly tell users that connect(2) is unavailable in capmode and that
CAP_CONNECT is meaningless.

-- 
You are receiving this mail because:
You are the assignee for the bug.