Cross referencing vendor PR https://github.com/openbsm/openbsm/pull/88

So.. I went down a wild rabbit hole here. len is int here becauase for some
reason we used int for all the fetch_*(3) functions. Upon deeper analysis:

I will open a PR to fix au_to_sock_inet128() upstream as well. Thanks for catching this

Yes I see the problem.. ADD_U_INT16 calls be16enc(), which assumes the input value is in host byte order and converts it to big-endian. However, sin6_port is already stored in network byte order (big-endian). On a little-endian system (like x86 or ARM), the CPU interprets those bytes as a byte-swapped integer, and then be16enc swaps them again. We just need a memcpy here.

a few years late to the party here but have you tested this?

Whoops -- my face is sure red over here! good catch

thank you

This looks promising. I would like to test it out, but I think it looks good.

Thanks @gbe I have merged this PR upstream btw

This looks ok at first glance, bu we need to make sure there is no conflicts with upstream. I can do this

@gbe can you submit a PR upstream to the openbsm project as well?

+1

Otherwise +1 from me

In D26922#600559, @kevans wrote:

In D26922#600534, @kib wrote:

Instead of trying to outguess all syscalls, might be add a TDP flag to indicate that AUDIT on exit does not need to be done. Then, in the special-case syscalls like *execve() and perhaps all users of kern_posix_exit(), call AUDIT_SYSCALL_EXIT() manually when you know the correct errno.

Hmm... I like it. I will do this.

SOCK_RAW is still used by other subsystems, e.g. configuring firewalls rules among other things. This is the main reason raw sockets were restricted within jails in the first place. I am not seeing how this patch protects other subsystems.

Working on this right now BTW, just waiting for CI to finish

I will take care of this commit. I thought this was done already

I am ok with this diff.

Looks good to me

Looks perfectly reasonable to me.

Break out the switch case statements for the new syscalls

• Fix comment