Luke Small wrote: > Would it be a good idea to make a pledge like call that limits a process > from connecting to ports and/or hosts? Maybe it could be done in way that > the kernel is made aware of the limitations like in a pledge call and while > the process is alive, the kernel spawns pf rules based upon the socket > ports that are created to connect to remote host ports.
The idea doesn't have a lot of traction, but someday I'd like to add a bpf matcher to connect() calls and let programs manage their own filters.
