Nevermind, forgot to set the following:
net.inet.ip.portrange.reservedlow: 0
net.inet.ip.portrange.reservedhigh: 0
With these set, portacl is working as expected.
On Thu, May 28, 2009 at 11:55 AM, Jon Passki jon.pas...@hursk.com wrote:
Hello,
Full documentation here:
http://blog.cykyc.org/2009/05/macportacl-and-no-love.html
Gist of it is that I enabled MAC_PORTACL and MAC, rebuilt the kernel
and installed it for testing. I was not able to get a non-super user
to open up a privileged port, though.
What am I doing wrong?
[2136] ~ sysctl -a security.mac
security.mac.max_slots: 4
security.mac.version: 3
security.mac.mmap_revocation_via_cow: 0
security.mac.mmap_revocation: 1
security.mac.portacl.rules:
security.mac.portacl.port_high: 1023
security.mac.portacl.autoport_exempt: 1
security.mac.portacl.suser_exempt: 1
security.mac.portacl.enabled: 1
[2136] ~ id
uid=1001(foo) gid=0(wheel) groups=0(wheel)
[2136] ~ sudo sysctl security.mac.portacl.rules=uid:1001:tcp:80
Password:
security.mac.portacl.rules: - uid:1001:tcp:80
[2136] ~ nc -l 80
nc: Permission denied
TIA,
Jon
--
Cheers,
Jon Passki, Partner
The Hursk Group, LLC
Obvia conspicimus, nubem pellente Mathesi.
e: jon.pas...@hursk.com
ph: 651/222.3020
cal:
http://www.google.com/calendar/hosted/hursk.com/embed?src=jon.passki%40hursk.com
pgp: 1BB0 A946 927B 93C3 ED6A 0466 6692 6C2C 84BE 4122
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
