Re: PR 291981: authpf under netlink, and a pfctl adoption flag

On 25 Jul 2026, at 9:51, Avinash Duduskar wrote:
> From: Avinash H. Duduskar <[email protected]>
>
>> The way to fix this is to just call libpfctl from change_filter() [...=
]
>> if libpfctl is missing functions I'll happily add them.
>
> Glad to drop the flag and go the libpfctl way.  But I want to be sure I=

> have read the scope right before I start, because I audited it and it
> came out a lot bigger than a missing function.
>
> The table, the addresses and the state kill authpf already does through=

> libpfctl.  What still forks is the ruleset load, and that part is the
> pf.conf parser: change_filter hands pfctl a file with macros, and
> turning that text into rules is parse.y, which is not in libpfctl.

Groan. I didn=E2=80=99t realise authpf changed rules. I had assumed it on=
ly added/deleted addresses in tables.
I=E2=80=99ve never used it myself, in case that wasn=E2=80=99t obvious al=
ready.

> So before I pick up a keyboard: is that really the scope you have in
> mind, or did you have a different design for how authpf gets its rules
> in without the fork?  You know parse.y far better than I do, so I would=

> rather understand the design you are picturing than guess at one.
>
Yeah, that=E2=80=99s an amount of work that=E2=80=99s not reasonable for =
this issue.
I=E2=80=99m not even sure we would want to lift all of parse.y into libpf=
ctl at all, and we certainly don=E2=80=99t want to do that in a hurry to =
fix something else.

Let me think about this for a bit. We may have to go down the horrible pa=
th anyway, or perhaps we can not drop root privs, but instead limit the c=
hild process through capsicum. Or perhaps there=E2=80=99s a MAC module wa=
y to do this. I know Kyle has in-progress work that may allow us to give =
non-root processes access to pf=E2=80=99s netlink interface.

Best regards,
Kristof