Re: pledge for sockets

> I can imagine pledge(2) becoming very complex if individual ports are
> blocked. It is not just the syscall, it's also the code in the
> kernel. From what I can gather, pledge is really to restrict processes
> to a subset of functions available, rather than restricting each
> individual argument, unless there are exceptional reasons for doing so.
>
> However, out of curiosity I've been tinkering with PF rules.
>
> Ruleset:
>
> block drop all
> pass in proto tcp from any to any port 65535 user test2
>
> Then running as user "test" (NOT test2):
>
> $ nc -l 65535
>
> Note nc stays there, probably opened the socket successfully.
>
> Even with "block reset all" in PF rules, nc does this.
>
> It would be nice if the "reset" keyword tells the kernel to return
> EACCES when bind(2) is called on a port blocked by PF rules for a
> particular user.

You really haven't got a clue.