[Bug 222632] Enable Capsicum for connect(2)

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Thu Sep 28 19:10:12 UTC 2017


--- Comment #10 from Shawn Webb <shawn.webb at hardenedbsd.org> ---
It turns out that SSL_connect doesn't call connect(2). SSL_connect assumes an
already-connected socket. Its job is to set up the SSL/TLS side of things.
Which is really good news.

I'm able to tell the non-capmode child process to perform the connect on behalf
of the capmode parent. This is a doable workaround. However, long-term, we
should figure out how to be able to call connect(2) in capmode. Until then, we
should explicitly tell users that connect(2) is unavailable in capmode and that
CAP_CONNECT is meaningless.

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list