Bug 217728 - [patch] restrict access to reserved ports in jails
Summary: [patch] restrict access to reserved ports in jails
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: Allan Jude
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2017-03-12 17:00 UTC by Matt Miller
Modified: 2017-08-24 14:12 UTC (History)
3 users (show)

See Also:

Attachments
patch to add the allow.reserved_port option to jail(8) (3.78 KB, patch)
2017-03-12 17:00 UTC, Matt Miller 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Miller 2017-03-12 17:00:01 UTC 
Created attachment 180751 [details]
patch to add the allow.reserved_port option to jail(8)

The attached patch adds a new jail(8) configuration option to deny the use of reserved ports inside jail. This is intended for use in shared-IP jails that set the "ipv4=inherit" option, and would not be useful in VNET-enabled jails. The primary use case is for delegating jail administration to ordinary users who would otherwise not be allowed access to run services reserved ports.

Without this patch, ordinary users who have root privileges inside a shared-IP jail have the ability to run services that potentially conflict with the host, such as SSH or Sendmail.
Comment 1 Mark Felder freebsd_committer freebsd_triage 2017-03-30 15:02:36 UTC 
I personally like this idea a lot. Anyone else have feedback?
Comment 2 Allan Jude freebsd_committer freebsd_triage 2017-03-30 15:04:43 UTC 
It defaults to allow, to avoid breaking existing jails, so I agree.
Comment 3 Steven Hartland freebsd_committer freebsd_triage 2017-03-30 15:09:52 UTC 
LGM
Comment 4 Allan Jude freebsd_committer freebsd_triage 2017-03-30 15:50:39 UTC 
https://reviews.freebsd.org/D10202
Comment 5 commit-hook freebsd_committer freebsd_triage 2017-06-06 02:15:19 UTC 
A commit references this bug:

Author: allanjude
Date: Tue Jun  6 02:15:01 UTC 2017
New revision: 319611
URL: https://svnweb.freebsd.org/changeset/base/319611

Log:
  Jails: Optionally prevent jailed root from binding to privileged ports

  You may now optionally specify allow.noreserved_ports to prevent root
  inside a jail from using privileged ports (less than 1024)

  PR:		217728
  Submitted by:	Matt Miller <mattm916@pulsar.neomailbox.ch>
  Reviewed by:	jamie, cem, smh
  Relnotes:	yes
  Differential Revision:	https://reviews.freebsd.org/D10202

Changes:
  head/sys/kern/kern_jail.c
  head/sys/sys/jail.h
  head/usr.sbin/jail/jail.8
Comment 6 Mark Linimon freebsd_committer freebsd_triage 2017-08-24 14:12:12 UTC 
Committed Tue Jun  6 02:15:01 UTC 2017.