kern/57492: Firewall can be disabled in securelevel 3

[Bernd Luevelsmeyer]

>Number:         57492
>Category:       kern
>Synopsis:       Firewall can be disabled in securelevel 3
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Oct 02 04:40:09 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator:     Bernd Luevelsmeyer
>Release:        FreeBSD 4.9-PRERELEASE i386
>Organization:
>Environment:
System: FreeBSD 4.9-PRERELEASE #0: Mon Sep 8 15:08:58 CEST 2003 i386


>Description:
    init(8) says, you cannot change ipfw rules in securelevel 3.
    It is possible, though, to disable the entire firewall,
    effectively deleting all rules and adding a rule "pass all
    from any to any".

>How-To-Repeat:
    On a machine that has a firewall and runs in securelevel 3,
    as root enter
      sysctl net.inet.ip.fw.enable=0
    You can now send and receive packets that otherwise would
    be rejected by the firewall.

>Fix:
    unknown
>Release-Note:
>Audit-Trail:
>Unformatted: