Re: dig may need an inet pledge?

2020-01-16 Thread Peter J. Philipp
On Thu, Jan 16, 2020 at 08:25:16PM +0100, Peter J. Philipp wrote: > > dig is supposed to use SOCK_DNS, and then not bother doing additional > > stuff. > > > > 105 is setsockopt. We would investigate if the setsockopt being done > > is required, or if it can be removed. After all, the "bind as a

Re: dig may need an inet pledge?

2020-01-16 Thread Peter J. Philipp
On Thu, Jan 16, 2020 at 12:13:27PM -0700, Theo de Raadt wrote: > Your example is vaguely inprecise enough that I cannot reproduce the > failure. If I could, I would ktrace it. Here is more (precise) data: -> beta$ cd /tmp beta$ ktrace -i dig @rhombus.centroid.eu +tcp delphinusdns.org Ab

Re: dig may need an inet pledge?

2020-01-16 Thread Theo de Raadt
Your example is vaguely inprecise enough that I cannot reproduce the failure. If I could, I would ktrace it. dig is supposed to use SOCK_DNS, and then not bother doing additional stuff. 105 is setsockopt. We would investigate if the setsockopt being done is required, or if it can be removed. A

dig may need an inet pledge?

2020-01-16 Thread Peter J. Philipp
Hi, I did a quick grep of dig's pledge: > beta$ grep pledge * dig.c: if (pledge("stdio rpath dns", NULL) == -1) { dig.c: perror("pledge"); dig.c: if (pledge("stdio dns", NULL) == -1) { dig.c: perror("pledge"); < and noticed that there is no inet pledge. The problem i