> I can imagine pledge(2) becoming very complex if individual ports are > blocked. It is not just the syscall, it's also the code in the > kernel. From what I can gather, pledge is really to restrict processes > to a subset of functions available, rather than restricting each > individual argument, unless there are exceptional reasons for doing so. > > However, out of curiosity I've been tinkering with PF rules. > > Ruleset: > > block drop all > pass in proto tcp from any to any port 65535 user test2 > > Then running as user "test" (NOT test2): > > $ nc -l 65535 > > Note nc stays there, probably opened the socket successfully. > > Even with "block reset all" in PF rules, nc does this. > > It would be nice if the "reset" keyword tells the kernel to return > EACCES when bind(2) is called on a port blocked by PF rules for a > particular user.
You really haven't got a clue.
