From owner-freebsd-bugs@FreeBSD.ORG Fri Dec 30 06:50:03 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DDF2416A41F for ; Fri, 30 Dec 2005 06:50:03 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 795A543D5F for ; Fri, 30 Dec 2005 06:50:02 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id jBU6o29l067023 for ; Fri, 30 Dec 2005 06:50:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id jBU6o2RC067022; Fri, 30 Dec 2005 06:50:02 GMT (envelope-from gnats) Resent-Date: Fri, 30 Dec 2005 06:50:02 GMT Resent-Message-Id: <200512300650.jBU6o2RC067022@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Christian Ullrich Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8F07016A41F for ; Fri, 30 Dec 2005 06:47:01 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 22E5A43D48 for ; Fri, 30 Dec 2005 06:47:01 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id jBU6l0G1093336 for ; Fri, 30 Dec 2005 06:47:00 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id jBU6l0kg093335; Fri, 30 Dec 2005 06:47:00 GMT (envelope-from nobody) Message-Id: <200512300647.jBU6l0kg093335@www.freebsd.org> Date: Fri, 30 Dec 2005 06:47:00 GMT From: Christian Ullrich To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Cc: Subject: kern/91082: ipfilter rule changes fail in securelevel 2 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2005 06:50:04 -0000 >Number: 91082 >Category: kern >Synopsis: ipfilter rule changes fail in securelevel 2 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Dec 30 06:50:01 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Christian Ullrich >Release: 6.0-STABLE >Organization: >Environment: FreeBSD legolas.chrullrich.de 6.0-STABLE FreeBSD 6.0-STABLE #0: Wed Dec 28 19:11:05 CET 2005 root@wt.chrullrich.de:/usr/obj/usr/src/sys/LEGOLAS i386 >Description: On FreeBSD 6.0, modifying ipfilter rule sets is disallowed in any securelevel >= 2. This behavior differs from earlier releases, the init(8) man page, and the requirements for changing ipnat rules, which are allowed up to securelevel 2. Release 3 of ipfilter initially required securelevel < 2 for rule changes as well, which was changed in revision 1.28 of src/sys/contrib/ipfilter/netinet/ip_fil.c, back in 2002. In FreeBSD 6, ipfilter 3 has been replaced by release 4, which, again, requires the lower securelevel. As noted above, that applies only to changes to filtering rules, not NAT rules. >How-To-Repeat: In securelevel 2, run anything which will change ipf filter rules. >Fix: --- sys/contrib/ipfilter/netinet/ip_fil_freebsd.c.orig Fri Dec 30 07:40:18 2005 +++ sys/contrib/ipfilter/netinet/ip_fil_freebsd.c Fri Dec 30 07:40:40 2005 @@ -421,7 +421,7 @@ friostat_t fio; #if (BSD >= 199306) && defined(_KERNEL) - if ((securelevel >= 2) && (mode & FWRITE)) + if ((securelevel >= 3) && (mode & FWRITE)) return EPERM; #endif >Release-Note: >Audit-Trail: >Unformatted: