From owner-freebsd-questions@FreeBSD.ORG Thu May 28 19:02:59 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9AC40106566B for ; Thu, 28 May 2009 19:02:59 +0000 (UTC) (envelope-from jon.passki@hursk.com) Received: from mail-gx0-f170.google.com (mail-gx0-f170.google.com [209.85.217.170]) by mx1.freebsd.org (Postfix) with ESMTP id 5FA6D8FC08 for ; Thu, 28 May 2009 19:02:58 +0000 (UTC) (envelope-from jon.passki@hursk.com) Received: by gxk18 with SMTP id 18so148358gxk.19 for ; Thu, 28 May 2009 12:02:57 -0700 (PDT) MIME-Version: 1.0 Received: by 10.151.123.1 with SMTP id a1mr3354805ybn.38.1243537376861; Thu, 28 May 2009 12:02:56 -0700 (PDT) In-Reply-To: References: Date: Thu, 28 May 2009 14:02:56 -0500 Message-ID: From: Jon Passki To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: MAC_PORTACL Not Allowing Non-Super User Access to Port X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 May 2009 19:03:00 -0000 Nevermind, forgot to set the following: net.inet.ip.portrange.reservedlow: 0 net.inet.ip.portrange.reservedhigh: 0 With these set, portacl is working as expected. On Thu, May 28, 2009 at 11:55 AM, Jon Passki wrote: > Hello, > > Full documentation here: > http://blog.cykyc.org/2009/05/macportacl-and-no-love.html > > Gist of it is that I enabled MAC_PORTACL and MAC, rebuilt the kernel > and installed it for testing.=A0 I was not able to get a non-super user > to open up a privileged port, though. > > What am I doing wrong? > > [2136] ~> sysctl -a security.mac > security.mac.max_slots: 4 > security.mac.version: 3 > security.mac.mmap_revocation_via_cow: 0 > security.mac.mmap_revocation: 1 > security.mac.portacl.rules: > security.mac.portacl.port_high: 1023 > security.mac.portacl.autoport_exempt: 1 > security.mac.portacl.suser_exempt: 1 > security.mac.portacl.enabled: 1 > [2136] ~> id > uid=3D1001(foo) gid=3D0(wheel) groups=3D0(wheel) > [2136] ~> sudo sysctl security.mac.portacl.rules=3Duid:1001:tcp:80 > Password: > security.mac.portacl.rules: =A0-> uid:1001:tcp:80 > [2136] ~> nc -l 80 > nc: Permission denied > > TIA, > > Jon > --=20 Cheers, Jon Passki, Partner The Hursk Group, LLC "Obvia conspicimus, nubem pellente Mathesi." e: jon.passki@hursk.com ph: 651/222.3020 cal: http://www.google.com/calendar/hosted/hursk.com/embed?src=3Djon.passki= %40hursk.com pgp: 1BB0 A946 927B 93C3 ED6A 0466 6692 6C2C 84BE 4122