From 8daf0bfbbb951c7a211e88c3775cb400a9825162 Mon Sep 17 00:00:00 2001
From: Roy Marples <roy@marples.name>
Date: Fri, 14 Aug 2026 15:16:38 +0100
Subject: [PATCH] privsep: Fix capsicum support on the control socket

We need getsockopt support for getpeereid.
---
 src/control.c |  2 +-
 src/dhcpcd.c  |  5 +++--
 src/privsep.c | 12 ++++++++++++
 src/privsep.h |  1 +
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/src/control.c b/src/control.c
index b1ade2aab..9164b7ab1 100644
--- a/src/control.c
+++ b/src/control.c
@@ -546,7 +546,7 @@ control_start1(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family)
 		goto err;
 
 #ifdef PRIVSEP_RIGHTS
-	if (IN_PRIVSEP(ctx) && ps_rights_limit_fd_fctnl(fd) == -1)
+	if (IN_PRIVSEP(ctx) && ps_rights_limit_fd_getsockopt(fd) == -1)
 		goto err;
 #endif
 
diff --git a/src/dhcpcd.c b/src/dhcpcd.c
index f015fa055..e4a8872a0 100644
--- a/src/dhcpcd.c
+++ b/src/dhcpcd.c
@@ -2487,9 +2487,10 @@ main(int argc, char **argv, char **envp)
 		ctx.options |= DHCPCD_FORKED; /* avoid socket unlink */
 		if (!(ctx.options & DHCPCD_MANAGER))
 			ctx.control_fd = control_open(argv[optind], family);
-		if (!(ctx.options & DHCPCD_MANAGER) && ctx.control_fd == -1)
+		if (!(ctx.options & DHCPCD_MANAGER) && ctx.control_fd == -1 &&
+		    errno != EACCES)
 			ctx.control_fd = control_open(argv[optind], AF_UNSPEC);
-		if (ctx.control_fd == -1)
+		if (ctx.control_fd == -1 && errno != EACCES)
 			ctx.control_fd = control_open(NULL, AF_UNSPEC);
 		if (ctx.control_fd != -1) {
 			if (!(ctx.options & DHCPCD_DUMPLEASE))
diff --git a/src/privsep.c b/src/privsep.c
index 65955007a..f35502e07 100644
--- a/src/privsep.c
+++ b/src/privsep.c
@@ -198,6 +198,18 @@ ps_rights_limit_ioctl(int fd)
 	return 0;
 }
 
+int
+ps_rights_limit_fd_getsockopt(int fd)
+{
+	cap_rights_t rights;
+
+	cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_EVENT, CAP_ACCEPT,
+	    CAP_GETSOCKOPT | CAP_FCNTL);
+	if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS)
+		return -1;
+	return 0;
+}
+
 int
 ps_rights_limit_fd_fctnl(int fd)
 {
diff --git a/src/privsep.h b/src/privsep.h
index 39e493400..7fe4d1f28 100644
--- a/src/privsep.h
+++ b/src/privsep.h
@@ -217,6 +217,7 @@ ssize_t ps_recvpsmsg(struct dhcpcd_ctx *, int, unsigned short,
 
 #ifdef PRIVSEP_RIGHTS
 int ps_rights_limit_ioctl(int);
+int ps_rights_limit_fd_getsockopt(int);
 int ps_rights_limit_fd_fctnl(int);
 int ps_rights_limit_fd_rdonly(int);
 int ps_rights_limit_fd_sockopt(int);