Messages in this thread | | | Date | Fri, 05 Feb 2010 12:41:18 +0800 | From | Cong Wang <> | Subject | Re: [RFC Patch v2] net: reserve ports for applications using fixed port numbers |
| |
Tetsuo Handa wrote: > Hello. > > Amerigo Wang wrote: >> diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c >> index 2b79377..d3e160a 100644 >> --- a/net/ipv4/inet_hashtables.c >> +++ b/net/ipv4/inet_hashtables.c >> @@ -456,6 +456,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, >> local_bh_disable(); >> for (i = 1; i <= remaining; i++) { >> port = low + (i + offset) % remaining; >> + if (inet_is_reserved_local_port(port)) >> + continue; >> head = &hinfo->bhash[inet_bhashfn(net, port, >> hinfo->bhash_size)]; >> spin_lock(&head->lock); > > I'm planning to add a LSM hook here. > > If root user sets min port value less than 1024 to > /proc/sys/net/ipv4/ip_local_port_range , a process without CAP_NET_BIND_SERVICE > capability can bind to privileged port by "bind() with port == 0" or "connect() > without bind()" because the condition is > > err = -EACCES; > if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE)) > goto out; > > I consider this is a security problem if MAC is enabled. MAC is used for > dividing root user's privilege. With MAC, somebody doing some part of root > user's jobs may set min port value to less than 1024. > > Also, some applications needs fixed local port numbers (e.g. 3128 for Squid, > 8080 for Tomcat). The port numbers I want to reserve are more complex than > simple min-max range like /proc/sys/net/ipv4/ip_local_reserved_ports . > > Therefore, TOMOYO wants to insert a LSM hook ( > http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/net/ipv4/udp.c#L235 > http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/net/ipv4/inet_connection_sock.c#L114 > http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/net/ipv4/inet_hashtables.c#L459 > ) and allow reserving local ports like > > deny_autobind 0-1023 > deny_autobind 3128 > deny_autobind 8080 > > so that > > applications which need such ports won't be unexpectedly blocked by > other application's temporary port usage (i.e. "bind() with port == 0" or > "connect() without bind()") > > and > > MAC guarantees that processes without CAP_NET_BIND_SERVICE can never bind > to privileged port >
Oh, IIUC, TOMOYO is something like SELinux? So, it is somewhat weird to let users to use TOMOYO to reserve the ports with MAC. For normal users /proc interface seems more friendly.
Thanks.
| |