Re: PR 291981: authpf under netlink, and a pfctl adoption flag

On 24 Jul 2026, at 5:32, Avinash Duduskar wrote:
> From: Avinash H. Duduskar <[email protected]>
>
> Hi all,
>
> Kristof asked me to bring this here from a private thread; it is a
> design question about authpf under the pf netlink conversion, and a
> small fix.
>
> authpf breaks on 15.x (PR 291981) at the exec.  change_filter hands the=

> child the root /dev/pf fd as -p /dev/fd/N, so its ioctls still work; bu=
t
> that flag carries only the device fd, and pfctl's first privileged
> netlink command (PFNL_CMD_BEGIN_ADDRS, since ba2a9207862) rides a fresh=

> socket it opens after the setresuid drop, so the kernel's per-command
> check sees the dropped cred and EPERMs.  Nobody authenticates.  The
> DIOCBEGINADDRS in the report is a stale label; the call is netlink now.=

>
Okay, so I did not understand this at all, because surely authpf only cal=
ls pfctl_open() once, and it does it before it drops privs.

Then I took a closer look at change_filter(), and now I wish I hadn=E2=80=
=99t.
No. We=E2=80=99re not doing that. We=E2=80=99re not forking a pfctl insta=
nce to do the work for us. Just no.
Let=E2=80=99s not double down on the horror.

The way to fix this is to just call libpftl from change_filter(), not thi=
s mess with pfctl and remapped fds. It can still drop privs or capsicumis=
e or whatever if it wants to, but if it calls libpfctl to do the work it=E2=
=80=99ll be much faster, much cleaner and it can just use the handle we o=
pened when we still could.

If libpfctl is missing functions I=E2=80=99ll happily add them, but we=E2=
=80=99re not doubling down on the wrong way.

=E2=80=94
Kristof