[Bug 259149] mac_portacl not in affect when running VNET jail

From: <bugzilla-noreply_at_freebsd.org>
Date: Sat, 16 Sep 2023 02:21:23 UTC

Zhenlei Huang <zlei@FreeBSD.org> changed:

           What    |Removed                     |Added
                 CC|                            |zlei@FreeBSD.org

--- Comment #4 from Zhenlei Huang <zlei@FreeBSD.org> ---
(In reply to Thomas Hurst from comment #3)
> Investigating this finds 'net.inet.ip.portrange.reservedhigh=1023' within a
> vnet jail, so mac_portacl doesn't get a chance to do anything.

The sysctl variable `net.inet.ip.portrange.reservedhigh` is a per-vnet one. So
it is default to 1023 for vnet jail. That is expected.

 * Reserved ports accessible only to root. There are significant
 * security considerations that must be accounted for when changing these,
 * but the security benefits can be great. Please be careful.
VNET_DEFINE(int, ipport_reservedhigh) = IPPORT_RESERVED - 1;    /* 1023 */
VNET_DEFINE(int, ipport_reservedlow);

SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedhigh,
        &VNET_NAME(ipport_reservedhigh), 0, "");

> As on the host this needs to be set to 0 to allow mac_portacl to operate,
> though to change this I had to drop the initial jail securelevel.

Tree indeed.

You are receiving this mail because:
You are the assignee for the bug.