https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259149
Zhenlei Huang <z...@freebsd.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |z...@freebsd.org
--- Comment #4 from Zhenlei Huang <z...@freebsd.org> ---
(In reply to Thomas Hurst from comment #3)
> Investigating this finds 'net.inet.ip.portrange.reservedhigh=1023' within a
> vnet jail, so mac_portacl doesn't get a chance to do anything.
The sysctl variable `net.inet.ip.portrange.reservedhigh` is a per-vnet one. So
it is default to 1023 for vnet jail. That is expected.
```
/*
* Reserved ports accessible only to root. There are significant
* security considerations that must be accounted for when changing these,
* but the security benefits can be great. Please be careful.
*/
VNET_DEFINE(int, ipport_reservedhigh) = IPPORT_RESERVED - 1; /* 1023 */
VNET_DEFINE(int, ipport_reservedlow);
SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedhigh,
CTLFLAG_VNET | CTLFLAG_RW | CTLFLAG_SECURE,
&VNET_NAME(ipport_reservedhigh), 0, "");
```
> As on the host this needs to be set to 0 to allow mac_portacl to operate,
> though to change this I had to drop the initial jail securelevel.
Tree indeed.
--
You are receiving this mail because:
You are the assignee for the bug.
