Date: Thu, 28 May 2009 14:02:56 -0500 From: Jon Passki <jon.passki@hursk.com> To: freebsd-questions@freebsd.org Subject: Re: MAC_PORTACL Not Allowing Non-Super User Access to Port Message-ID: <cc6847e40905281202x1f4a6620qaf8d64aed479db04@mail.gmail.com> In-Reply-To: <cc6847e40905280955k7ce63734na4509425ce06bcc7@mail.gmail.com> References: <cc6847e40905280955k7ce63734na4509425ce06bcc7@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Nevermind, forgot to set the following: net.inet.ip.portrange.reservedlow: 0 net.inet.ip.portrange.reservedhigh: 0 With these set, portacl is working as expected. On Thu, May 28, 2009 at 11:55 AM, Jon Passki <jon.passki@hursk.com> wrote: > Hello, > > Full documentation here: > http://blog.cykyc.org/2009/05/macportacl-and-no-love.html > > Gist of it is that I enabled MAC_PORTACL and MAC, rebuilt the kernel > and installed it for testing.=A0 I was not able to get a non-super user > to open up a privileged port, though. > > What am I doing wrong? > > [2136] ~> sysctl -a security.mac > security.mac.max_slots: 4 > security.mac.version: 3 > security.mac.mmap_revocation_via_cow: 0 > security.mac.mmap_revocation: 1 > security.mac.portacl.rules: > security.mac.portacl.port_high: 1023 > security.mac.portacl.autoport_exempt: 1 > security.mac.portacl.suser_exempt: 1 > security.mac.portacl.enabled: 1 > [2136] ~> id > uid=3D1001(foo) gid=3D0(wheel) groups=3D0(wheel) > [2136] ~> sudo sysctl security.mac.portacl.rules=3Duid:1001:tcp:80 > Password: > security.mac.portacl.rules: =A0-> uid:1001:tcp:80 > [2136] ~> nc -l 80 > nc: Permission denied > > TIA, > > Jon > --=20 Cheers, Jon Passki, Partner The Hursk Group, LLC "Obvia conspicimus, nubem pellente Mathesi." e: jon.passki@hursk.com ph: 651/222.3020 cal: http://www.google.com/calendar/hosted/hursk.com/embed?src=3Djon.passki= %40hursk.com pgp: 1BB0 A946 927B 93C3 ED6A 0466 6692 6C2C 84BE 4122
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?cc6847e40905281202x1f4a6620qaf8d64aed479db04>