From owner-cvs-all  Mon Jan 13  0:20: 6 2003
Delivered-To: cvs-all@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 4CD8637B401; Mon, 13 Jan 2003 00:20:05 -0800 (PST)
Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id BE99543F1E; Mon, 13 Jan 2003 00:20:04 -0800 (PST)
	(envelope-from dillon@apollo.backplane.com)
Received: from apollo.backplane.com (localhost [127.0.0.1])
	by apollo.backplane.com (8.12.6/8.12.6) with ESMTP id h0D8JsYp001903;
	Mon, 13 Jan 2003 00:19:54 -0800 (PST)
	(envelope-from dillon@apollo.backplane.com)
Received: (from dillon@localhost)
	by apollo.backplane.com (8.12.6/8.12.6/Submit) id h0D8JsJc001902;
	Mon, 13 Jan 2003 00:19:54 -0800 (PST)
Date: Mon, 13 Jan 2003 00:19:54 -0800 (PST)
From: Matthew Dillon <dillon@apollo.backplane.com>
Message-Id: <200301130819.h0D8JsJc001902@apollo.backplane.com>
To: Pawel Jakub Dawidek <nick@garage.freebsd.pl>
Cc: cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG
Subject: Re: cvs commit: src/sbin/ipfw ipfw.8 ipfw2.c
References: <200301120331.h0C3VA2H040455@repoman.freebsd.org> <20030113075934.GE9430@garage.freebsd.pl> <200301130807.h0D87urr001783@apollo.backplane.com> <20030113081749.GF9430@garage.freebsd.pl>
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
List-ID: <cvs-all.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20cvs-all>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20cvs-all>
X-Loop: FreeBSD.ORG


:Exactly, but:
:
:SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, enable, CTLFLAG_RW,
:    &fw_enable, 0, "Enable ipfw");
:
:So where are adequate checks?
:I haven't check, but it looks like we can manipulate net.inet.ip.fw.enable
:even if securelevel >=3D 3. Am I wrong?
:
:--=20
:Pawel Jakub Dawidek
:UNIX Systems Administrator

    You are looking at the old ipfw code.  Look at the sysctl's in
    ip_fw2.c instead.  Either way it is not really relevant to my
    commit, I didn't make any changes to the IPFW kernel code, only 
    to the userland program.

						-Matt


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message