From owner-cvs-src Thu Feb 20 21:54: 9 2003 Delivered-To: cvs-src@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B8B2437B405; Thu, 20 Feb 2003 21:54:07 -0800 (PST) Received: from smtp4.server.rpi.edu (smtp4.server.rpi.edu [128.113.2.4]) by mx1.FreeBSD.org (Postfix) with ESMTP id B2AD443FAF; Thu, 20 Feb 2003 21:54:06 -0800 (PST) (envelope-from drosih@rpi.edu) Received: from [128.113.24.47] (gilead.netel.rpi.edu [128.113.24.47]) by smtp4.server.rpi.edu (8.12.7/8.12.7) with ESMTP id h1L5s5qX013827; Fri, 21 Feb 2003 00:54:05 -0500 Mime-Version: 1.0 X-Sender: drosih@mail.rpi.edu Message-Id: In-Reply-To: <200302210528.h1L5SS0H092948@repoman.freebsd.org> References: <200302210528.h1L5SS0H092948@repoman.freebsd.org> Date: Fri, 21 Feb 2003 00:54:04 -0500 To: "Crist J. Clark" , src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org From: Garance A Drosihn Subject: Re: cvs commit: src/sys/netinet in_pcb.c (priv ports) Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-RPI-Spam-Score: -1.9 () IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,SIGNATURE_SHORT_DENSE,SPAM_PHRASE_01_02 X-Scanned-By: MIMEDefang 2.28 Sender: owner-cvs-src@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG At 9:28 PM -0800 2/20/03, Crist J. Clark wrote: >cjc 2003/02/20 21:28:28 PST > > Modified files: > sys/netinet in_pcb.c > Log: > The ancient and outdated concept of "privileged ports" in UNIX-type > OSes has probably caused more problems than it ever solved. Allow the > user to retire the old behavior by specifying their own privileged > range with, > > net.inet.ip.portrange.reservedhigh default = IPPORT_RESERVED - 1 > net.inet.ip.portrange.reservedlo default = 0 > > Now you can run that webserver without ever needing root at all. Or > just imagine, an ftpd that can really drop privileges, rather than > just set the euid, and still do PORT data transfers from 20/tcp. While this can be useful, it would be nice if there was also an exception-mechanism, instead of just a "lo" and "high" value. If I want to run a web server without needing root, then I'd like to allow port 80, and not an entire range of 0-80 or 80-1024. Would that be hard to implement? Maybe even tied to a userid? (so any process from a given user could bind to the port, but not any process from any user). All this change effects is whether the bind() will succeed, right? Maybe have the exception tied to the existence-of and access-to some specific file? [apologies if this was discussed somewhere and I missed it...] -- Garance Alistair Drosehn = gad@gilead.netel.rpi.edu Senior Systems Programmer or gad@freebsd.org Rensselaer Polytechnic Institute or drosih@rpi.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-src" in the body of the message