From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Denis V. Lunev" Subject: Re: [PATCH] do not give access to 1-1024 ports for autobinding Date: Wed, 10 Oct 2007 20:59:13 +0400 Message-ID: <470D04E1.9030505@gmail.com> References: <20071010143449.GA10796@iris.sw.ru> <20071010084137.1963122e@freepuppy.rosehill> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "Denis V. Lunev" , davem@davemloft.net, netdev@vger.kernel.org To: Stephen Hemminger Return-path: Received: from nf-out-0910.google.com ([64.233.182.190]:20909 "EHLO nf-out-0910.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754177AbXJJQ5a (ORCPT ); Wed, 10 Oct 2007 12:57:30 -0400 Received: by nf-out-0910.google.com with SMTP id g13so228909nfb for ; Wed, 10 Oct 2007 09:57:28 -0700 (PDT) In-Reply-To: <20071010084137.1963122e@freepuppy.rosehill> Sender: netdev-owner@vger.kernel.org List-Id: netdev.vger.kernel.org Stephen Hemminger wrote: > On Wed, 10 Oct 2007 18:34:49 +0400 > "Denis V. Lunev" wrote: > >> This patch prevents possibility to give 1-1024 port range for autobinding. >> {1, 1} may only takes some sense for deep embedded people. >> >> Signed-off-by: Denis V. Lunev >> >> --- ./net/ipv4/sysctl_net_ipv4.c.port2 2007-10-10 17:46:48.000000000 +0400 >> +++ ./net/ipv4/sysctl_net_ipv4.c 2007-10-10 18:08:00.000000000 +0400 >> @@ -25,7 +25,7 @@ extern int sysctl_ip_nonlocal_bind; >> #ifdef CONFIG_SYSCTL >> static int zero; >> static int tcp_retr1_max = 255; >> -static int ip_local_port_range_min[] = { 1, 1 }; >> +static int ip_local_port_range_min[] = { 1024, 1024 }; >> static int ip_local_port_range_max[] = { 65535, 65535 }; >> #endif >> >> - > > That only limits the sysctl, which seems completely counter productive. > Sounds like more of the "stop root from shooting themselves" patches. > They have sense for the case of multiple network namespaces, where root in the other namespace can be treated as a user to initial namespace.