>Number:         17881
>Category:       kern
>Synopsis:       kernel option NOPRIVPORTS changed to a sysctl
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 08 07:48:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Joe Reed
>Release:        NetBSD 1.6E
>Organization:
	
>Environment:
	
	
System: NetBSD bork 1.6E NetBSD 1.6E (ETHERTEST) #22: Wed Aug 7 10:55:54 EST 2002 root@bork:/usr/src/sys/arch/i386/compile/ETHERTEST i386
Architecture: i386
Machine: i386
>Description:
	As explained in http://mail-index.netbsd.org/tech-kern/2002/08/06/0003.html
	the kernel option NOPRIVPORTS, sets a compile-time setting to allow or 
	disallow unpriv users to bind to ports <1024.  This does not follow the 
	precident set by the FORWARDING or GATEWAY options, which only set a default
	value and can be modified by a sysctl.

	The patches below add 2 new sysctls (net.inet{,6}.ip{,6}.privports) which
	control whether or not the unpriv user can bind to ports <1024.  The kernel
	option NOPRIVPORTS is used as a default value.  These sysctls may not be 
	modified if the securelevel is >0 (this is the value that's checked for the
	forwscrt sysctl).
>How-To-Repeat:
	
>Fix:
	patches can be downloaded from the following locations:
	http://deadparrot.cwru.edu/downloads/NetBSD/netinet.diff
	http://deadparrot.cwru.edu/downloads/NetBSD/netinet6.diff
	
>Release-Note:
>Audit-Trail:
>Unformatted: