lkml.org 
[lkml]   [1999]   [Jan]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Problem with sockets under 2.0.36
On Sat, Jan 30, 1999 at 02:03:07PM +1300, Chris Wedgwood wrote:
> On Fri, Jan 29, 1999 at 01:19:59PM -0800, Shane Wegner wrote:
>
> > I've encountered this problem with a patch under the 2.0.36 kernel.
> > I have used this patch under 2.0.33-2.0.35 without any problem but
> > recently it has been flakey.
>
> > + /* The low and high bytes of the port must be swaped inorder to work */
> > + if ( (current->uid >= 1000) && (current->sgid != 103)
> > + && ((ntohl(sin->sin_addr.s_addr) & 0xFFFFFF00) != (127 << 24))
> > + && (sin->sin_port != htons(43)) /* whois */
> > + && (sin->sin_port != htons(53)) /* dns */
> > + && (sin->sin_port != htons(70)) /* gofer */
> > + && (sin->sin_port != htons(79)) /* finger */
> > + && (sin->sin_port != htons(80)) /* http */
> > + && (sin->sin_port != htons(113)) /* ident */
> > + && (sin->sin_port != htons(443)) /* https */
> > + && (sin->sin_port != htons(517)) /* talk */
> > + && (sin->sin_port != htons(518)) ) /* ntalk */
> > + for (i = 0;i < NGROUPS;i++)
> > + {
> > + if (current->groups[i] == 103)
> > + allow_connect = 1;
>
> [...]
>
> Oo... yuck. No offense intended, in 2.0.x you don't have many
> options. You might want to look at 2.2.x -- it have `capabilites'
> that you can give to processes. This would allow you to hack login
> (or whatever) to give certain processes the ability to bind to ports
> < 1024....
>
Hi,

As far as I know 2.2.0 doesn't have the ability to do what I need it to.
The idea behind that patch was to restrict all outbound connections to
users with a uid < 1000 or in group 103 except to certain ports. The fact
that it works for a while indicates the patch is sound but I am by no
means a kernel hacker so I don't know why it would stop working after a
day or two of uptime.

Furthermore, I wrote a little program that makes a test connection to a
remote site and executed it as a user which was not in group 103 and it
went through but when I put it into the user's crontab, it failed as it
should. So it's only succeeding when the user is logged in.

--
Shane Wegner: shane@cm.nu
Tel: (604) 930-0530
Sysadmin, Continuum Systems: http://www.cm.nu
Personal website: http://www.cm.nu/~shane
PGP: keyid: 2048/F5C2BD91
Fingerprint: 8C 48 B9 D8 53 BB D8 EF
76 BB DB A2 1C 0D 1D 87
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.057 / U:0.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site