freebsd stable - Jul 2005 - BIND vs. mac_portacl

Hello,

I've loaded the mac_portacl module but BIND doesn't properly work with 
it. My sysctl values:

net.inet.ip.portrange.reservedlow: 0
net.inet.ip.portrange.reservedhigh: 0
security.mac.portacl.rules: 
uid:55:tcp:53,uid:55:udp:53,uid:55:tcp:953,uid:55:udp:953
security.mac.portacl.port_high: 1023
security.mac.portacl.suser_exempt: 1
security.mac.portacl.enabled: 1

Thus, my system behaves in the standard UNIX way, root should be able to 
bind to privileged ports. It is very common that softwares bind to a 
privileged port as root and then change tu an unprivileged user. So does 
BIND with the -u switch, but when I start it in this way with this 
command line: /usr/local/bind/sbin/named -u bind -t /usr/local/bind -c 
/etc/named.conf
, I get:

Jul  4 23:58:13 server named[18476]: socket.c:2885: unexpected error:
Jul  4 23:58:13 server named[18476]: bind: Operation not permitted
Jul  4 23:58:13 server named[18476]: socket.c:2885: unexpected error:
Jul  4 23:58:13 server named[18476]: bind: Operation not permitted
Jul  4 23:58:13 server named[18476]: socket.c:2885: unexpected error:
Jul  4 23:58:13 server named[18476]: bind: Operation not permitted
Jul  4 23:58:13 server named[18476]: socket.c:2885: unexpected error:
Jul  4 23:58:13 server named[18476]: bind: Operation not permitted
Jul  4 23:58:13 server named[18476]: socket.c:2885: unexpected error:
Jul  4 23:58:13 server named[18476]: bind: Operation not permitted

The bind user has the uid 55. I've added a rule for it, as You can see, 
but it doesn't help. I get this error with the ruleset can be seen 
above, and also without any rules. But apache works. It can change to 
the www user. Proftpd can change to the proftpd user. BIND is the only 
one that doesn't work. What's wrong?

Cheers,

G?bor K?vesd?n

On Tue, Jul 05, 2005 at 12:17:40AM +0200, K?vesd?n G?bor
wrote:
> The bind user has the uid 55. I've added a rule for it, as You can see,
> but it doesn't help. I get this error with the ruleset can be seen 
> above, and also without any rules. But apache works. It can change to 
> the www user. Proftpd can change to the proftpd user. BIND is the only 
> one that doesn't work. What's wrong?
The portrange stuff doesn't work for IPv6 sockets at the moment,
and I suspect that BIND is trying to bind to some IPv6 ports (or
maybe to the IPv6 wildcard port, which can cover the IPv4 addresses
too). I'm planning to fix the portrange stuff soon, but just haven't
had time yet - I'll try to get to it by the end of the week.

If you don't actually want to use IPv6, you could give explicit
addresses to named using the listen-on and query-source directives.
Alternatively, a kernel without IPv6 might work.

	David.