Date: Mon, 14 May 2001 17:09:28 +0300 From: Peter Pentchev <roam@orbitel.bg> To: Igor Podlesny <poige@morning.ru> Cc: freebsd-security@FreeBSD.ORG Subject: Re: ipfw rules and securelevel Message-ID: <20010514170927.A849@ringworld.oblivion.bg> In-Reply-To: <19322552168.20010514220610@morning.ru>; from poige@morning.ru on Mon, May 14, 2001 at 10:06:10PM %2B0700 References: <Pine.LNX.4.33.0105141802230.18115-100000@apsara.barc.ernet.in> <10320318256.20010514212856@morning.ru> <19322552168.20010514220610@morning.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, May 14, 2001 at 10:06:10PM +0700, Igor Podlesny wrote: > > >> Dear friends, > >> Even in securelevel 3 I can bypass ipfw rules. In securelevel 3 I > >> as root can change the variable "net.inet.ip.fw.enable" using sysctl. When > >> I run a command > > >> sysctl -w net.inet.ip.fw.enable=0 > > >> It disables the ipfw rules. > > >> Is it a feature or hole in freebsd. > > > doesn't matter how it is called, only matters how it hurts... (it does) > > >> please help > > the "patch" (hard to call it a patch, but nevertheless) is adding > CTLFLAG_SECURE to the relevant definition of the node: > > this diff out is for 3.5 stable: > > 92c92 > < SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, enable, CTLFLAG_RW, > --- > > SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, enable, CTLFLAG_RW|CTLFLAG_SECURE, Patches/diffs are usually much easier to review and apply if they are in context or unified diff format - this helps when the patch is made against a possibly changed file :) And.. well.. it might be obvious to you (in this case it's pretty obvious to figure out ;), but still it helps a lot to mention which file(s) the patch is against :) G'luck, Peter -- I am the meaning of this sentence. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010514170927.A849>