On Mon, Sep 21, 2026 at 10:10:38AM -0600, Theo de Raadt wrote:
> It only reaches tun_set_capabilities()
>
> Shrug.
>

I had something similar in my mangled version of the diff. Mine was worse
though as it added a new ioctl. So this is better imo.

>
> > > > -	if (pledge("stdio", NULL) == -1)
> > > > +	if (pledge("stdio vmm", NULL) == -1)
> >
> > I connot review the vmd part, but I like it.
> >
> > > > Index: sys/kern/kern_pledge.c
> > > > ===================================================================
> > > > RCS file: /cvs/src/sys/kern/kern_pledge.c,v
> > > > diff -u -p -r1.368 kern_pledge.c
> > > > --- sys/kern/kern_pledge.c	19 Sep 2026 17:21:52 -0000	1.368
> > > > +++ sys/kern/kern_pledge.c	20 Sep 2026 04:06:14 -0000
> > > > @@ -48,6 +48,7 @@
> > > >  #include <net/route.h>
> > > >  #include <net/if.h>
> > > >  #include <net/if_var.h>
> > > > +#include <net/if_tun.h>
> > > >  #include <netinet/in.h>
> > > >  #include <netinet6/in6_var.h>
> > > >  #include <netinet6/nd6.h>
> > > > @@ -1380,6 +1381,12 @@ pledge_ioctl(struct proc *p, long com, s
> > > >  			case VMM_IOC_CREATE:
> > > >  				return (0);
> > > >  			}
> > > > +		}
> > > > +		if ((fp->f_type == DTYPE_VNODE) &&
> > > > +		    (vp->v_type == VCHR) &&
> > > > +		    (cdevsw[major(vp->v_rdev)].d_open == tapopen)) {
> > > > +			if (com == TUNSCAP)
> > > > +				return 0;
> > > >  		}
> > > >  	}
> > > >  #endif
>
>