Re: chromium: disable IP_TOS for UDP

[Theo de Raadt]

Theo de Raadt <dera...@openbsd.org> wrote:

> Should our kernel play a different kind of game here?

Correction, lets return the intended errno.  Anyways the purpose here
is to not permit the deep dive into the kernel.

pledge_sockopt() cannot translate one optname to another optname,
that's not what I'm suggesting.

Index: /sys/kern/kern_pledge.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_pledge.c,v
diff -u -p -u -r1.365 kern_pledge.c
--- /sys/kern/kern_pledge.c     4 Sep 2026 02:38:28 -0000       1.365
+++ /sys/kern/kern_pledge.c     8 Sep 2026 22:53:36 -0000
@@ -1447,6 +1460,8 @@ pledge_sockopt(struct proc *p, int set, 
                        switch (optname) {
                        case IP_TOS:
                                return (0);
+                       case IPV6_TCLASS:
+                               return (ENOPROTOOPT);
                        }
                }
                break;
@@ -1455,6 +1470,8 @@ pledge_sockopt(struct proc *p, int set, 
                        switch (optname) {
                        case IPV6_TCLASS:
                                return (0);
+                       case IPV6_TCLASS:
+                               return (ENOPROTOOPT);
                        }
                }
                break;