CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/03 20:13:45
Modified files:
sys/kern : kern_pledge.c uipc_syscalls.c
sys/sys : pledge.h
Log message:
tighten pledge_sockopt()s level/optname checks for different types of sockets
tl;dr: the meaning of the setsockopt and getsockopt level and optname
arguments are dependent on the type of the socket you're working
with, they can't be safely understood without knowing the address
family and protocol.
i think we've been able to ignore to socket address family and
protocol so far by luck, particularly because openbsd (henning)
removed a bunch of address families like AF_IPX and AF_NETATALK.
like AF_INET and AF_INET6, they use values from the wire protocol
as identifiers in the ABI, particularly sub protocol numbers like
IPPROTO_TCP. there's no guarantee these numbers don't overlap with
a protocol from another address family. netipx used IPXPROTO_SPX
like how AF_INET uses IPPROTO_IP, but it's only luck that their
values don't collide with each other or another protocol. this
principle applies to all socktypes though.
this is also reflected in the way sockopts are handled by protocol
handlers in the kernel. with the obvious exception of SOL_SOCKET,
sockopts are handled by a function pointer in the specific protocol,
which shaves levels off and passes them up to the generic address
family handling as appropriate.
the diff below extends pledge_sockopt() so it takes the address
family and protocol into proper consideration.
my first version of this diff has been in snaps, and it caused
problems because software assumed that it could try and fiddle with
tcp nodelay on any SOCK_STREAM type socket. where's the craftsmanship?
deraadt@ relaxed the code in snaps a bit to allow that, which is
also included here, but should be removed in the future once we've
fixed the obvious offenders.
ok deraadt@
