Tests added. I forgot to add the review link into the commit message... oops. Closing this.

Use memcpy(3) to copy pci_conf data into compat structures instead of assigning
members one by one.

Good to see more Capsicumization efforts going on. I just had a few pedantic suggestions. Otherwise, this generally looks good.

In D48222#1101641, @markj wrote:

Another option might be to extend connectat(2) to support IP sockets. For instance, connectat(s, {AF_INET, 0.0.0.0, 0}), disallowed in capability, could permit sendto(s) in capability mode. Or, connectat(s, {AF_INET, 192.168.1.0}, 0) permits sendto() to 192.168.1.0/24. This would allow syslogd to transmit to any sockaddr, so weakens the sandbox a bit, but it makes userspace much simpler.

I do not like how complicated this is getting, but the code all looks good.

Thanks for finding and fixing all of these.

In D26456#1087673, @jfree wrote:

In D26456#1087672, @arrowd wrote:

Any progress on this?

Yes, I’ve been working on it. I will try to get them in this weekend. Sorry for the wait

Add missing error checking on memory allocation

• Fix sysctl(8) usage
• Do not use atf_skip(3) in test head - it causes failure

• Fix argument parsing in syslogd_start()
• Assign address to interface for host_action test

Use sendmsg(2) to send iovec list.

In D26456#1087672, @arrowd wrote:

Any progress on this?

Separate the "basic" test into three separate tests:

• unix
• inet
• inet6

• Use sysctl's -n flag to print value without variable name. Silly mistake on my part.
• Skip test if INET and INET6 are unsupported by kernel.

• Minor style changes
• Only call getsockopt() and getpeername() when Debug is non-zero

• Use calloc(3) instead of malloc(3) for array allocations.
• Add missing error checking for a memory allocation

Address Mark's comments: use calloc() instead of malloc() for
memory allocations. This is done to avoid potential integer overflow
in total allocation size.