[Bug 259149] mac_portacl not in affect when running VNET jail

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259149

Zhenlei Huang <zlei@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zlei@FreeBSD.org

--- Comment #4 from Zhenlei Huang <zlei@FreeBSD.org> ---
(In reply to Thomas Hurst from comment #3)
> Investigating this finds 'net.inet.ip.portrange.reservedhigh=1023' within a
> vnet jail, so mac_portacl doesn't get a chance to do anything.

The sysctl variable `net.inet.ip.portrange.reservedhigh` is a per-vnet one. So
it is default to 1023 for vnet jail. That is expected.

```
/*
 * Reserved ports accessible only to root. There are significant
 * security considerations that must be accounted for when changing these,
 * but the security benefits can be great. Please be careful.
 */
VNET_DEFINE(int, ipport_reservedhigh) = IPPORT_RESERVED - 1;    /* 1023 */
VNET_DEFINE(int, ipport_reservedlow);

SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedhigh,
        CTLFLAG_VNET | CTLFLAG_RW | CTLFLAG_SECURE,
        &VNET_NAME(ipport_reservedhigh), 0, "");
```



> As on the host this needs to be set to 0 to allow mac_portacl to operate,
> though to change this I had to drop the initial jail securelevel.

Tree indeed.

-- 
You are receiving this mail because:
You are the assignee for the bug.