Re: PR 291981: authpf under netlink, and a pfctl adoption flag

On 25 Jul 2026, at 18:10, Kristof Provost wrote:
> Let me think about this for a bit. We may have to go down the horrible =
path anyway, or perhaps we can not drop root privs, but instead limit the=
 child process through capsicum. Or perhaps there=E2=80=99s a MAC module =
way to do this. I know Kyle has in-progress work that may allow us to giv=
e non-root processes access to pf=E2=80=99s netlink interface.
>
I rather wish I knew more about capsicum right now.

=46rom the examples I=E2=80=99ve looked at so far it doesn=E2=80=99t look=
 trivial. I=E2=80=99m pretty sure we can usefully restrict a child proces=
s, but we=E2=80=99d still have to have access to the relevant file(s), an=
d those files might include other files, so that becomes a bit annoying.

I wondered about an alternative approach where we create a libcasper serv=
ice for pf access, but that seems to not contemplate the scenario of a ch=
ild process exec()-ing something else.

The least-bad answer here might be to wait for that mac module to land.

=E2=80=94
Kristof