freebsd stable - Aug 2018 - Bind to port <1024 in jail

20.08.2018 21:47, Stefan Bethke wrote:
> I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and I?d
rather have it run as a non-privileged user.  The program doesn?t provide a
facility to drop privs after binding the ports. I?m planning to run it in a
jail.
> 
> After some googling, it appears that a couple of years ago I should have
been able to do:
> sysctl net.inet.ip.portrange.reservedhigh=0
> and allow all processes to bind to ?low? ports. This does not work in my
jails on a 11-stable host.
> 
> $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
> net.inet.ip.portrange.reservedhigh: 1023
> sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted
> 
> Securelevel should not interfere:
> $ sysctl kern.securelevel
> kern.securelevel: -1
> 
> Is there a way to allow regular processes to bind to low ports?
Yes. Just use mac_portacl kernel module: kldload mac_portacl

Once loaded, it duplicates net.inet.ip.portrange.reservedhigh protection
with its own security.mac.portacl.port_high, so it's safe to disable
"reservedhigh" for whole system by running sysctl
net.inet.ip.portrange.reservedhigh=0
for host.

The trick is that mac_portacl provides a way to selectively give permission for
non-root UID
to bind low ports:

security.mac.portacl.rules=uid:88:tcp:80,uid:88:tcp:443,uid:53:tcp:53,uid:53:udp:53

It works just fine for a host and I use it for name servers utilizing port 53
for a box with dynamically created interfaces, so it may bind the port for
distinct IP addresses
after it dropped privilegies when new interface is created and get new IP
assigned.

I have not tried it for a jails, though. Please try and respond.

Am 20.08.2018 um 16:59 schrieb Eugene Grosbein <eugen at
grosbein.net>:
> 
> 20.08.2018 21:47, Stefan Bethke wrote:
> 
>> I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and
I?d rather have it run as a non-privileged user.  The program doesn?t provide a
facility to drop privs after binding the ports. I?m planning to run it in a
jail.
>> 
>> After some googling, it appears that a couple of years ago I should
have been able to do:
>> sysctl net.inet.ip.portrange.reservedhigh=0
>> and allow all processes to bind to ?low? ports. This does not work in
my jails on a 11-stable host.
>> 
>> $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
>> net.inet.ip.portrange.reservedhigh: 1023
>> sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted
>> 
>> Securelevel should not interfere:
>> $ sysctl kern.securelevel
>> kern.securelevel: -1
>> 
>> Is there a way to allow regular processes to bind to low ports?
> 
> Yes. Just use mac_portacl kernel module: kldload mac_portacl
> 
> Once loaded, it duplicates net.inet.ip.portrange.reservedhigh protection
> with its own security.mac.portacl.port_high, so it's safe to disable
> "reservedhigh" for whole system by running sysctl
net.inet.ip.portrange.reservedhigh=0
> for host.
> 
> The trick is that mac_portacl provides a way to selectively give permission
for non-root UID
> to bind low ports:
> 
>
security.mac.portacl.rules=uid:88:tcp:80,uid:88:tcp:443,uid:53:tcp:53,uid:53:udp:53
> 
> It works just fine for a host and I use it for name servers utilizing port
53
> for a box with dynamically created interfaces, so it may bind the port for
distinct IP addresses
> after it dropped privilegies when new interface is created and get new IP
assigned.
> 
> I have not tried it for a jails, though. Please try and respond.
Thanks, but do I understand correctly that the security.mac.portacl.rules are
system-wide and not per-jail?

I?m running ~10 jails on this host, and I don?t want to allow all of them to
bind to low ports.


Stefan

-- 
Stefan Bethke <stb at lassitu.de>   Fon +49 151 14070811