This looks promising. I would like to test it out, but I think it looks good.

Thanks @gbe I have merged this PR upstream btw

This looks ok at first glance, bu we need to make sure there is no conflicts with upstream. I can do this

@gbe can you submit a PR upstream to the openbsm project as well?

+1

Otherwise +1 from me

In D26922#600559, @kevans wrote:

In D26922#600534, @kib wrote:

Instead of trying to outguess all syscalls, might be add a TDP flag to indicate that AUDIT on exit does not need to be done. Then, in the special-case syscalls like *execve() and perhaps all users of kern_posix_exit(), call AUDIT_SYSCALL_EXIT() manually when you know the correct errno.

Hmm... I like it. I will do this.

SOCK_RAW is still used by other subsystems, e.g. configuring firewalls rules among other things. This is the main reason raw sockets were restricted within jails in the first place. I am not seeing how this patch protects other subsystems.

Working on this right now BTW, just waiting for CI to finish

I will take care of this commit. I thought this was done already

I am ok with this diff.

Looks good to me

Looks perfectly reasonable to me.

Break out the switch case statements for the new syscalls

• Fix comment