"Theo de Raadt" <deraadt@openbsd.org> wrote:
> 105 is setsockopt
> 
> Please ktrace -di, and kdump to identify the parameters to the final setsockopt
> before it gets pledge SIGABRT.
> 
> The first argument to setsockopt is the socket fd, and it has 2 arguments
> are level and optname.
> 
> Scan up the kdump manually to see how that fd is allocated.  My guess is that
> this socket is created as AF_INET6, and the setsockopt parameters are IP_TOS.
> But this could be another new setsockopt that also needs bypass treatment in
> pledge.
> 
> Show the combination of proto, level, and optname.
> 
> Please don't send a massive kdump.  Try to do what I've explained.

Here are the last few lines of output from kdump:

 26783 mosh-client CALL  socket(AF_INET6,0x2<SOCK_DGRAM>,0)
 26783 mosh-client RET   socket 5
 26783 mosh-client CALL  setsockopt(5,0<ip>,3,0x7207d0cea92c,4)
 26783 mosh-client PLDG  setsockopt, "inet", errno 1 Operation not permitted
 26783 mosh-client PSIG  SIGABRT SIG_DFL

Looks like you were right; 3 is IP_TOS.

-- 
James