Subject: kern/17881: kernel option NOPRIVPORTS changed to a sysctl
To: None <gnats-bugs@gnats.netbsd.org>
From: None <jnr@po.cwru.edu>
List: netbsd-bugs
Date: 08/08/2002 10:46:35
>Number: 17881
>Category: kern
>Synopsis: kernel option NOPRIVPORTS changed to a sysctl
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: change-request
>Submitter-Id: net
>Arrival-Date: Thu Aug 08 07:48:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator: Joe Reed
>Release: NetBSD 1.6E
>Organization:
>Environment:
System: NetBSD bork 1.6E NetBSD 1.6E (ETHERTEST) #22: Wed Aug 7 10:55:54 EST 2002 root@bork:/usr/src/sys/arch/i386/compile/ETHERTEST i386
Architecture: i386
Machine: i386
>Description:
As explained in http://mail-index.netbsd.org/tech-kern/2002/08/06/0003.html
the kernel option NOPRIVPORTS, sets a compile-time setting to allow or
disallow unpriv users to bind to ports <1024. This does not follow the
precident set by the FORWARDING or GATEWAY options, which only set a default
value and can be modified by a sysctl.
The patches below add 2 new sysctls (net.inet{,6}.ip{,6}.privports) which
control whether or not the unpriv user can bind to ports <1024. The kernel
option NOPRIVPORTS is used as a default value. These sysctls may not be
modified if the securelevel is >0 (this is the value that's checked for the
forwscrt sysctl).
>How-To-Repeat:
>Fix:
patches can be downloaded from the following locations:
http://deadparrot.cwru.edu/downloads/NetBSD/netinet.diff
http://deadparrot.cwru.edu/downloads/NetBSD/netinet6.diff
>Release-Note:
>Audit-Trail:
>Unformatted: