From owner-freebsd-questions@freebsd.org Tue Oct 13 18:46:13 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C3F31A12FA6 for ; Tue, 13 Oct 2015 18:46:13 +0000 (UTC) (envelope-from fbsd@xtaz.co.uk) Received: from mail.xtaz.uk (tao.xtaz.uk [IPv6:2001:8b0:202::10]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 8EC9CF03 for ; Tue, 13 Oct 2015 18:46:13 +0000 (UTC) (envelope-from fbsd@xtaz.co.uk) Received: by mail.xtaz.uk (Postfix, from userid 1001) id 920F720AEE90; Tue, 13 Oct 2015 19:46:09 +0100 (BST) Date: Tue, 13 Oct 2015 19:46:09 +0100 From: Matt Smith To: FreeBSD Questions Subject: setsockopt Operation not permitted as non-root user Message-ID: <20151013184609.GD90075@xtaz.uk> Mail-Followup-To: Matt Smith , FreeBSD Questions MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2015 18:46:13 -0000 I'm running net/sslh in transparent mode using IPFW to forward packets to/from it. This works fine with no issues but I have to run it as root. I was wondering if there is any way to use this running as a non-root user. When I try this I get the following error: sslh-select[35325]: setsockopt IP_BINDANY:1:Operation not permitted I was thinking I could maybe use mac_portacl(4) to allow this but it doesn't seem to work. I tried setting security.mac.portacl.rules to uid:65534:tcp:423,uid:65534:tcp:444 and set net.inet.ip.portrange.reservedhigh to 0. I still get the same error. The reason I'm using those ports is because of the IPFW rules: ipfw add 00020 fwd 10.0.0.10,4444 tcp from 192.168.1.0/24 to 10.0.0.10 443 in via re0 ipfw add 00021 fwd 10.0.0.10,4444 tcp from 10.0.0.10 423,444 to 192.168.1.0/24 out via re0 192.168.1.0/24 isn't the actual network I'm using, but you get the jist. And I have openssh and a webserver listening on 423 and 444, with sslh on port 4444. Alternatively Linux appears to have something called capabilities and specifically CAP_NET_ADMIN where it appears you can give the process enough extra privedges to do this itself. I assume the equivalent on FreeBSD is mac_portacl though? -- Matt