secure level 2 unable to modify pf rules

[Andrew Konstantinov]

On Thu, Jan 20, 2005 at 07:32:01PM -0800, Andrew Konstantinov wrote:
> Hello,
> 
> The manual page for securelevel says that secure level 3 provides the same
> functionality as secure level 2 plus the protection of pf/ipf/ipfw against
> modification. Since pf/ipf/ipfw protection is an addition, I assume that it
> should not be present with secure level 2. For some reason that's not the
> reality.
> 
> gater# id
> uid=0(root) gid=0(wheel) groups=0(wheel), 5(operator)
> gater# uname -rs
> FreeBSD 5.3-RELEASE-p5
> gater# sysctl kern.securelevel
> kern.securelevel: 2
> gater# pfctl -F all
> pfctl: pfctl_clear_rules: Operation not permitted
> gater#
> 
> Is there a bug in the documentation or in the implementation of secure level?
> Or perhaps, did I misinterpret something?

Replying to myself. This should fix the bug if it's really a bug and not a
feature.

--- sys/contrib/pf/net/pf_ioctl.c.orig  Thu Jan 20 22:40:35 2005
+++ sys/contrib/pf/net/pf_ioctl.c       Thu Jan 20 22:41:24 2005
@@ -1058,9 +1058,9 @@

        /* XXX keep in sync with switch() below */
 #ifdef __FreeBSD__
-       if (securelevel_gt(td->td_ucred, 1))
+       if (securelevel_gt(td->td_ucred, 2))
 #else
-       if (securelevel > 1)
+       if (securelevel > 2)
 #endif
		switch (cmd) {
		case DIOCGETRULES:
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20050120/7b7bef40/attachment.bin