src/lib/libcasper, branch main FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=main 2026-06-09T11:34:13Z cap_net: add tests for limits drop 2026-06-09T11:34:13Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-06-09T11:34:13Z urn:sha1:97edd37e6279d76efee89d466550587246161dc9 Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56992 cap_net.3: Clarify monotonic reduction in permitted operations 2026-05-20T20:49:22Z Ed Maste emaste@FreeBSD.org 2026-05-20T20:27:49Z urn:sha1:59601a75d6fb1300b1aec2977eaa6adeb0300684 Reviewed by: markj, oshogbo Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57141 libcasper: switch from select(2) to poll(2) 2026-05-20T19:34:50Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-05-18T15:32:49Z urn:sha1:a10bc81d333e04664c1a1d6024c580794b079eca The previous implementation used FD_SET() on a stack-allocated fd_set, which is an out-of-bounds write whenever the socket fd is >= FD_SETSIZE (1024). poll(2) takes an array indexed by slot rather than by fd value, so it has no FD_SETSIZE limit. Approved by: so Security: FreeBSD-SA-26:22.libcasper Security: CVE-2026-39461 Reported by: Joshua Rogers Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56695 cap_net: do not allow new limits to drop keys from the old ones 2026-05-18T15:18:43Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-05-12T08:33:41Z urn:sha1:d705a519525f2acae3c1efba11436ec6ee8aea0a If the old limit had family/hosts/sockaddr set, the new limit must have them too. Before, a missing key in the new limit was treated as "allow any", which let a caller silently extend their limits. Reported by: Joshua Rogers of AISLE Research Team Reviewed by: markj MFC after: 1 day Differential Revision: https://reviews.freebsd.org/D56991 cap_sysctl: fix typo 2026-05-13T19:59:38Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-05-13T19:57:20Z urn:sha1:45fa572b94e7c61de5797ea877af3dade91af23f cap_net: fix typos 2026-05-13T19:59:38Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-05-13T19:56:09Z urn:sha1:efc1f50ec4999e4222e1f1b3d6d2f668f9169afb cap_dns: fix typos 2026-05-13T19:59:37Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-05-13T19:55:29Z urn:sha1:4569c022db0bd2242eed883c33207980ddb00019 cap_fileargs: fix typo 2026-05-13T19:59:37Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-05-13T19:51:44Z urn:sha1:69e9d5d306699d40148256722d7240dbb5da8fb5 cap_net: fix error propagation for ENOTCAPABLE in cap_getaddrinfo 2026-05-13T16:42:45Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-05-12T09:48:56Z urn:sha1:ee04ee95ab386147c57d3b4efcc5774e8d64330b Fixes: b60053fde172 ("libcasper: Fix inconsistent error codes of cap_get{addr,name}info()") cap_dns: plug a memory leak 2026-04-10T10:20:27Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-04-10T10:19:05Z urn:sha1:9f1be4bfebd08b249877267a1634c249c9f6d221