do not give access to 1-1024 ports for autobinding
Subsystems (2)
PATCH 1/1 do not give access to 1-1024 ports for autobinding
This patch prevents possibility to give 1-1024 port range for autobinding. {1, 1} may only takes some sense for deep embedded people.
net/ipv4/sysctl_net_ipv4.c renamed from net/ipv4/sysctl_net_ipv4.c.port2 +1 -1
@@ -25,7 +25,7 @@ extern int sysctl_ip_nonlocal_bind;#ifdef CONFIG_SYSCTL static int zero;static int tcp_retr1_max =255 ; -static int ip_local_port_range_min[] = {1 ,1 }; +static int ip_local_port_range_min[] = {1024 ,1024 };static int ip_local_port_range_max[] = {65535 ,65535 };#endif
Quoted 8 lines · On Wed, 10 Oct 2007 18:34:49 +0400 "Denis V. Lunev" <[email protected]> wrote:
This patch prevents possibility to give 1-1024 port range for autobinding. {1, 1} may only takes some sense for deep embedded people.
Signed-off-by Denis V. Lunev <[email protected]>
net/ipv4/sysctl_net_ipv4.c extern int sysctl_ip_nonlocal_bind;
Quoted 9 lines
net/ipv4/sysctl_net_ipv4.c renamed from net/ipv4/sysctl_net_ipv4.c.port2 +1
-2@@ -25,7 +25,7 @@ extern int sysctl_ip_nonlocal_bind;#ifdef CONFIG_SYSCTL static int zero;static int tcp_retr1_max =255 ; -static int ip_local_port_range_min[] = {1 ,1 }; +static int ip_local_port_range_min[] = {1024 ,1024 };static int ip_local_port_range_max[] = {65535 ,65535 };#endif -
That only limits the sysctl, which seems completely counter productive. Sounds like more of the "stop root from shooting themselves" patches.
Signature · 1 line
Stephen Hemminger <[email protected]>
Quoted 19 lines · Stephen Hemminger
Quoted 16 lines · On Wed, 10 Oct 2007 18:34:49 +0400 "Denis V. Lunev" <[email protected]> wrote:
This patch prevents possibility to give 1-1024 port range for autobinding. {1, 1} may only takes some sense for deep embedded people.
Signed-off-by Denis V. Lunev <[email protected]>net/ipv4/sysctl_net_ipv4.c renamed from net/ipv4/sysctl_net_ipv4.c.port2 +1
-1@@ -25,7 +25,7 @@ extern int sysctl_ip_nonlocal_bind;#ifdef CONFIG_SYSCTL static int zero;static int tcp_retr1_max =255 ; -static int ip_local_port_range_min[] = {1 ,1 }; +static int ip_local_port_range_min[] = {1024 ,1024 };static int ip_local_port_range_max[] = {65535 ,65535 };#endif
Quoted 5 lines
Quoted 1 line
-
That only limits the sysctl, which seems completely counter productive. Sounds like more of the "stop root from shooting themselves" patches.
They have sense for the case of multiple network namespaces, where root in the other namespace can be treated as a user to initial namespace.
Quoted 20 lines · On Wed, 10 Oct 2007 20:59:13 +0400 "Denis V. Lunev" <[email protected]> wrote:
Quoted 19 lines · Stephen Hemminger
Quoted 16 lines · On Wed, 10 Oct 2007 18:34:49 +0400 "Denis V. Lunev" <[email protected]> wrote:
This patch prevents possibility to give 1-1024 port range for autobinding. {1, 1} may only takes some sense for deep embedded people.
Signed-off-by Denis V. Lunev <[email protected]>net/ipv4/sysctl_net_ipv4.c renamed from net/ipv4/sysctl_net_ipv4.c.port2 +1
-1@@ -25,7 +25,7 @@ extern int sysctl_ip_nonlocal_bind;#ifdef CONFIG_SYSCTL static int zero;static int tcp_retr1_max =255 ; -static int ip_local_port_range_min[] = {1 ,1 }; +static int ip_local_port_range_min[] = {1024 ,1024 };static int ip_local_port_range_max[] = {65535 ,65535 };#endif
Quoted 8 lines
Quoted 5 lines
Quoted 1 line
-
That only limits the sysctl, which seems completely counter productive. Sounds like more of the "stop root from shooting themselves" patches.
They have sense for the case of multiple network namespaces, where root in the other namespace can be treated as a user to initial namespace.
IMHO don't want to treat root as a complete idiot like normal users. As long as what root requests doesn't create a security problem, it should be allowed. The port space is per namespace right? The sysctl values should be per namespace as well.
Signature · 1 line
Stephen Hemminger <[email protected]>
David Miller
maintainerFrom: "Denis V. Lunev" <[email protected]>
Date: Wed, 10 Oct 2007 20:59:13 +0400
Quoted 2 lines
They have sense for the case of multiple network namespaces, where root in the other namespace can be treated as a user to initial namespace.
This is a silly limitation to impose just for the sake of namespaces, please don't add it.
David Miller
maintainerFrom: Stephen Hemminger <[email protected]>
Date: Wed, 10 Oct 2007 08:41:37 -0700
Quoted 19 lines
Quoted 16 lines · On Wed, 10 Oct 2007 18:34:49 +0400 "Denis V. Lunev" <[email protected]> wrote:
This patch prevents possibility to give 1-1024 port range for autobinding. {1, 1} may only takes some sense for deep embedded people.
Signed-off-by Denis V. Lunev <[email protected]>net/ipv4/sysctl_net_ipv4.c renamed from net/ipv4/sysctl_net_ipv4.c.port2 +1
-1@@ -25,7 +25,7 @@ extern int sysctl_ip_nonlocal_bind;#ifdef CONFIG_SYSCTL static int zero;static int tcp_retr1_max =255 ; -static int ip_local_port_range_min[] = {1 ,1 }; +static int ip_local_port_range_min[] = {1024 ,1024 };static int ip_local_port_range_max[] = {65535 ,65535 };#endif
Quoted 4 lines
Quoted 1 line
-
That only limits the sysctl, which seems completely counter productive. Sounds like more of the "stop root from shooting themselves" patches.
Agreed, we shouldn't be changing these values.
David Miller
maintainerFrom: "Denis V. Lunev" <[email protected]>
Date: Wed, 10 Oct 2007 18:34:49 +0400
Quoted 4 lines
This patch prevents possibility to give 1-1024 port range for autobinding. {1, 1} may only takes some sense for deep embedded people.
Signed-off-by Denis V. Lunev <[email protected]>
Administrators can configure their systems however they want, the numbers are valid port numbers, so we should not prevent the possibility.