Nevermind, forgot to set the following: net.inet.ip.portrange.reservedlow: 0 net.inet.ip.portrange.reservedhigh: 0
With these set, portacl is working as expected. On Thu, May 28, 2009 at 11:55 AM, Jon Passki <jon.pas...@hursk.com> wrote: > Hello, > > Full documentation here: > http://blog.cykyc.org/2009/05/macportacl-and-no-love.html > > Gist of it is that I enabled MAC_PORTACL and MAC, rebuilt the kernel > and installed it for testing. I was not able to get a non-super user > to open up a privileged port, though. > > What am I doing wrong? > > [2136] ~> sysctl -a security.mac > security.mac.max_slots: 4 > security.mac.version: 3 > security.mac.mmap_revocation_via_cow: 0 > security.mac.mmap_revocation: 1 > security.mac.portacl.rules: > security.mac.portacl.port_high: 1023 > security.mac.portacl.autoport_exempt: 1 > security.mac.portacl.suser_exempt: 1 > security.mac.portacl.enabled: 1 > [2136] ~> id > uid=1001(foo) gid=0(wheel) groups=0(wheel) > [2136] ~> sudo sysctl security.mac.portacl.rules=uid:1001:tcp:80 > Password: > security.mac.portacl.rules: -> uid:1001:tcp:80 > [2136] ~> nc -l 80 > nc: Permission denied > > TIA, > > Jon > -- Cheers, Jon Passki, Partner The Hursk Group, LLC "Obvia conspicimus, nubem pellente Mathesi." e: jon.pas...@hursk.com ph: 651/222.3020 cal: http://www.google.com/calendar/hosted/hursk.com/embed?src=jon.passki%40hursk.com pgp: 1BB0 A946 927B 93C3 ED6A 0466 6692 6C2C 84BE 4122 _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
