From owner-freebsd-questions@FreeBSD.ORG Thu May 28 17:15:52 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 89DDC1065673 for ; Thu, 28 May 2009 17:15:52 +0000 (UTC) (envelope-from jon.passki@hursk.com) Received: from yx-out-2324.google.com (yx-out-2324.google.com [74.125.44.28]) by mx1.freebsd.org (Postfix) with ESMTP id 5233A8FC1B for ; Thu, 28 May 2009 17:15:51 +0000 (UTC) (envelope-from jon.passki@hursk.com) Received: by yx-out-2324.google.com with SMTP id 8so2976167yxb.13 for ; Thu, 28 May 2009 10:15:51 -0700 (PDT) MIME-Version: 1.0 Received: by 10.151.123.1 with SMTP id a1mr3133512ybn.38.1243529746664; Thu, 28 May 2009 09:55:46 -0700 (PDT) Date: Thu, 28 May 2009 11:55:46 -0500 Message-ID: From: Jon Passki To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: MAC_PORTACL Not Allowing Non-Super User Access to Port X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 May 2009 17:15:52 -0000 Hello, Full documentation here: http://blog.cykyc.org/2009/05/macportacl-and-no-love.html Gist of it is that I enabled MAC_PORTACL and MAC, rebuilt the kernel and installed it for testing.=A0 I was not able to get a non-super user to open up a privileged port, though. What am I doing wrong? [2136] ~> sysctl -a security.mac security.mac.max_slots: 4 security.mac.version: 3 security.mac.mmap_revocation_via_cow: 0 security.mac.mmap_revocation: 1 security.mac.portacl.rules: security.mac.portacl.port_high: 1023 security.mac.portacl.autoport_exempt: 1 security.mac.portacl.suser_exempt: 1 security.mac.portacl.enabled: 1 [2136] ~> id uid=3D1001(foo) gid=3D0(wheel) groups=3D0(wheel) [2136] ~> sudo sysctl security.mac.portacl.rules=3Duid:1001:tcp:80 Password: security.mac.portacl.rules: -> uid:1001:tcp:80 [2136] ~> nc -l 80 nc: Permission denied TIA, Jon