MAC_PORTACL Not Allowing Non-Super User Access to Port

[Jon Passki]

Nevermind, forgot to set the following:
net.inet.ip.portrange.reservedlow: 0
net.inet.ip.portrange.reservedhigh: 0

With these set, portacl is working as expected.


On Thu, May 28, 2009 at 11:55 AM, Jon Passki <jon.passki at hursk.com> wrote:
> Hello,
>
> Full documentation here:
> http://blog.cykyc.org/2009/05/macportacl-and-no-love.html
>
> Gist of it is that I enabled MAC_PORTACL and MAC, rebuilt the kernel
> and installed it for testing.  I was not able to get a non-super user
> to open up a privileged port, though.
>
> What am I doing wrong?
>
> [2136] ~> sysctl -a security.mac
> security.mac.max_slots: 4
> security.mac.version: 3
> security.mac.mmap_revocation_via_cow: 0
> security.mac.mmap_revocation: 1
> security.mac.portacl.rules:
> security.mac.portacl.port_high: 1023
> security.mac.portacl.autoport_exempt: 1
> security.mac.portacl.suser_exempt: 1
> security.mac.portacl.enabled: 1
> [2136] ~> id
> uid=1001(foo) gid=0(wheel) groups=0(wheel)
> [2136] ~> sudo sysctl security.mac.portacl.rules=uid:1001:tcp:80
> Password:
> security.mac.portacl.rules:  -> uid:1001:tcp:80
> [2136] ~> nc -l 80
> nc: Permission denied
>
> TIA,
>
> Jon
>



-- 
Cheers,

Jon Passki, Partner
The Hursk Group, LLC

"Obvia conspicimus, nubem pellente Mathesi."

e: jon.passki at hursk.com
ph: 651/222.3020
cal: http://www.google.com/calendar/hosted/hursk.com/embed?src=jon.passki%40hursk.com
pgp: 1BB0 A946 927B 93C3 ED6A  0466 6692 6C2C 84BE 4122