From owner-freebsd-bugs@FreeBSD.ORG Sun Nov 25 19:40:00 2007 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CA0A216A41B for ; Sun, 25 Nov 2007 19:40:00 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id A861013C46E for ; Sun, 25 Nov 2007 19:40:00 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id lAPJe0So081154 for ; Sun, 25 Nov 2007 19:40:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id lAPJe0t3081153; Sun, 25 Nov 2007 19:40:00 GMT (envelope-from gnats) Resent-Date: Sun, 25 Nov 2007 19:40:00 GMT Resent-Message-Id: <200711251940.lAPJe0t3081153@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Hugo Saro Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A114016A417 for ; Sun, 25 Nov 2007 19:39:25 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 8F6CA13C44B for ; Sun, 25 Nov 2007 19:39:25 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.2/8.14.2) with ESMTP id lAPJdMSB037115 for ; Sun, 25 Nov 2007 19:39:22 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.2/8.14.1/Submit) id lAPJdM0R037114; Sun, 25 Nov 2007 19:39:22 GMT (envelope-from nobody) Message-Id: <200711251939.lAPJdM0R037114@www.freebsd.org> Date: Sun, 25 Nov 2007 19:39:22 GMT From: Hugo Saro To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/118247: netstat/sockstat reporting incorrect information due to MAC_PARTITION X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Nov 2007 19:40:00 -0000 >Number: 118247 >Category: kern >Synopsis: netstat/sockstat reporting incorrect information due to MAC_PARTITION >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Nov 25 19:40:00 UTC 2007 >Closed-Date: >Last-Modified: >Originator: Hugo Saro >Release: FreeBSD 7.0-BETA3 amd64 >Organization: >Environment: FreeBSD samba.multiverse.local 7.0-BETA3 FreeBSD 7.0-BETA3 #0: Sun Nov 25 03:53:45 WET 2007 klr@zaurak.bsdlan.org:/usr/obj/usr/src/sys/ZAURAK amd64 >Description: sockstat and netstat do not show the correct number of connections while security.mac.partition.enabled is set. I am starting the jail with setpmac partition/XXX /etc/rc.d/jail start samba. See below. Should this happen ? I am very interested in further isolating jails with mac_partition, but not being able to netstat/sockstat from inside the jail (works fine from the host, as expected, however if done under setpmac, the following happens: host# setpmac partition/9009 netstat -anfinet && echo -- && sockstat -4l -- USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root sshd 39843 3 tcp4 10.0.90.1:22 *:* root smbd 39813 18 tcp4 10.0.90.1:445 *:* root smbd 39813 19 tcp4 10.0.90.1:139 *:* root nmbd 39809 6 udp4 10.0.90.1:137 *:* root nmbd 39809 7 udp4 10.0.90.1:138 *:* root nmbd 39809 8 udp4 10.0.90.1:137 *:* root nmbd 39809 9 udp4 10.0.90.1:138 *:* root sshd 1462 3 tcp4 192.168.0.110:22 *:* host# netstat -anfinet && echo -- && sockstat -4l Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp4 0 0 10.0.90.1.139 192.168.0.1.55432 ESTABLISHED tcp4 0 0 10.0.90.1.22 192.168.0.1.54898 ESTABLISHED tcp4 0 0 10.0.90.1.139 *.* LISTEN tcp4 0 0 10.0.90.1.445 *.* LISTEN tcp4 0 0 10.0.90.1.22 *.* LISTEN tcp4 0 0 192.168.0.110.22 *.* LISTEN tcp4 0 48 192.168.0.110.22 192.168.0.1.52590 ESTABLISHED udp4 0 0 10.0.90.1.138 *.* udp4 0 0 10.0.90.1.137 *.* udp4 0 0 10.0.90.1.138 *.* udp4 0 0 10.0.90.1.137 *.* -- USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root sshd 39843 3 tcp4 10.0.90.1:22 *:* root smbd 39813 18 tcp4 10.0.90.1:445 *:* root smbd 39813 19 tcp4 10.0.90.1:139 *:* root nmbd 39809 6 udp4 10.0.90.1:137 *:* root nmbd 39809 7 udp4 10.0.90.1:138 *:* root nmbd 39809 8 udp4 10.0.90.1:137 *:* root nmbd 39809 9 udp4 10.0.90.1:138 *:* root sshd 1462 3 tcp4 192.168.0.110:22 *:* I might be missing something obvious, but MAC_PARTITION shouldn't affect the output of netstat/sockstat. >How-To-Repeat: host# sysctl security.mac.partition.enabled=0 security.mac.partition.enabled: 1 -> 0 jail# netstat -an -f inet netstat: kvm not available: /dev/mem: No such file or directory Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp4 0 0 10.0.90.1.139 192.168.0.1.55432 ESTABLISHED tcp4 0 160 10.0.90.1.22 192.168.0.1.54898 ESTABLISHED tcp4 0 0 10.0.90.1.139 *.* LISTEN tcp4 0 0 10.0.90.1.445 *.* LISTEN tcp4 0 0 10.0.90.1.22 *.* LISTEN udp4 0 0 10.0.90.1.138 *.* udp4 0 0 10.0.90.1.137 *.* udp4 0 0 10.0.90.1.138 *.* udp4 0 0 10.0.90.1.137 *.* host# /etc/rc.d/sysctl reload security.mac.partition.enabled: 0 -> 1 jail# netstat -an -f inet netstat: kvm not available: /dev/mem: No such file or directory >Fix: >Release-Note: >Audit-Trail: >Unformatted: