[Bug 259149] mac_portacl not in affect when running VNET jail
Date: Wed, 13 Oct 2021 18:31:57 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259149
Bug ID: 259149
Summary: mac_portacl not in affect when running VNET jail
Product: Base System
Version: 13.0-RELEASE
Hardware: amd64
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: bugs@FreeBSD.org
Reporter: uros@gruber.si
I was trying to use mac_portacl and initial test on host works as described.
sysctl is set as follows
security.mac.portacl.rules: uid:1000:tcp:88
security.mac.portacl.port_high: 1023
security.mac.portacl.autoport_exempt: 1
security.mac.portacl.suser_exempt: 1
security.mac.portacl.enabled: 1
While testing with jails I stumble upon weird issue.
Using jail with either alias IP or host IP everything seems to work just file.
Output from `truss nc -l 88` as non root user
sigaction(SIGPIPE,{ SIG_IGN SA_RESTART ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0
(0x0)
socket(PF_INET,SOCK_DGRAM|SOCK_CLOEXEC,0) = 3 (0x3)
close(3) = 0 (0x0)
socket(PF_INET,SOCK_STREAM,IPPROTO_TCP) = 3 (0x3)
setsockopt(3,SOL_SOCKET,SO_REUSEPORT,0x7fffffffa7d4,4) = 0 (0x0)
bind(3,{ AF_INET 0.0.0.0:88 },16) = 0 (0x0)
listen(3,1) = 0 (0x0)
After this it started to listen on port 88
jls -nj alias2
devfs_ruleset=0 nodying enforce_statfs=2 host=new ip4=disable ip6=disable
jid=417 linux=new name=alias2 osreldate=1300139 osrelease=13.0-RELEASE parent=0
path=/jails/alias2/m persist securelevel=-1 sysvmsg=new sysvsem=new sysvshm=new
vnet=inherit allow.chflags allow.nomlock allow.nomount allow.mount.nodevfs
allow.mount.nofdescfs allow.mount.nolinprocfs allow.mount.nonullfs
allow.mount.noprocfs allow.mount.notmpfs allow.mount.nozfs allow.noquotas
allow.raw_sockets allow.noread_msgbuf allow.reserved_ports allow.noset_hostname
allow.socket_af allow.suser allow.sysvipc allow.unprivileged_proc_debug
children.cur=0 children.max=0 cpuset.id=15 host.domainname="" host.hostid=0
host.hostname=alias2.dev host.hostuuid=00000000-0000-0000-0000-000000000000
ip4.addr=172.20.0.14 ip4.saddrsel ip6.addr= ip6.saddrsel linux.osname=Linux
linux.osrelease=3.17.0 linux.oss_version=198144
But on jail with VNET enabled Output from `truss nc -l 88` as non root user
sigaction(SIGPIPE,{ SIG_IGN SA_RESTART ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0
(0x0)
socket(PF_INET,SOCK_DGRAM|SOCK_CLOEXEC,0) = 3 (0x3)
close(3) = 0 (0x0)
socket(PF_INET,SOCK_STREAM,IPPROTO_TCP) = 3 (0x3)
setsockopt(3,SOL_SOCKET,SO_REUSEPORT,0x7fffffffa7d4,4) = 0 (0x0)
bind(3,{ AF_INET 0.0.0.0:88 },16) ERR#13 'Permission denied'
close(3) = 0 (0x0)
jls -nj vnet2
devfs_ruleset=0 nodying enforce_statfs=2 host=new ip4=inherit ip6=inherit
jid=453 linux=new name=vnet2 osreldate=1300139 osrelease=13.0-RELEASE parent=0
path=/jails/vnet2/m persist securelevel=-1 sysvmsg=new sysvsem=new sysvshm=new
vnet=new allow.chflags allow.nomlock allow.nomount allow.mount.nodevfs
allow.mount.nofdescfs allow.mount.nolinprocfs allow.mount.nonullfs
allow.mount.noprocfs allow.mount.notmpfs allow.mount.nozfs allow.noquotas
allow.raw_sockets allow.noread_msgbuf allow.reserved_ports allow.noset_hostname
allow.socket_af allow.suser allow.sysvipc allow.unprivileged_proc_debug
children.cur=0 children.max=0 cpuset.id=5 host.domainname="" host.hostid=0
host.hostname=vnet2.dev host.hostuuid=00000000-0000-0000-0000-000000000000
ip4.addr= ip4.saddrsel ip6.addr= ip6.saddrsel linux.osname=Linux
linux.osrelease=3.17.0 linux.oss_version=198144
ifconfig for vnet2 jail
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
pflog0: flags=0<> metric 0 mtu 33160
groups: pflog
epair0b: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:aa:dd:12:46:0b
inet 172.20.0.3 netmask 0xffff0000 broadcast 172.20.255.255
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
Same thing works on both for root. Looks like that this port <1024 still
applied somehow when using VNET even though mac_portacl is doing it's job on
other cases.
Expected behaviour for port that is not allowed via mac_portacl throws me this
sigaction(SIGPIPE,{ SIG_IGN SA_RESTART ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0
(0x0)
socket(PF_INET,SOCK_DGRAM|SOCK_CLOEXEC,0) = 3 (0x3)
close(3) = 0 (0x0)
socket(PF_INET,SOCK_STREAM,IPPROTO_TCP) = 3 (0x3)
setsockopt(3,SOL_SOCKET,SO_REUSEPORT,0x7fffffffa7d4,4) = 0 (0x0)
bind(3,{ AF_INET 0.0.0.0:80 },16) ERR#1 'Operation not
permitted'
close(3) = 0 (0x0)
So it's clear that error is not the same as if I try allowed 88 port.
Is all this expected behaviour or what could cause this to work differently.
--
You are receiving this mail because:
You are the assignee for the bug.