> On Sat, Feb 25, 2017 at 11:34:19PM -0500, Peter Colberg wrote: > > >Synopsis: pfctl -T show not permitted when kern.securelevel=2 > > >Category: kernel > > >Environment: > > System : OpenBSD 6.0 > > Details : OpenBSD 6.0 (GENERIC.MP) #2319: Tue Jul 26 13:00:43 > > MDT 2016 > > > > [email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP > > > > Architecture: OpenBSD.amd64 > > Machine : amd64 > > >Description: > > When attempting to list the contents of a pf table and the > > kernel is set to securelevel 2, pfctl -T show fails with > > `Operation not permitted'. pfctl -vT show works as expected. > > >How-To-Repeat: > > # sysctl kern.securelevel > > > > > > > > kern.securelevel=1 > > > > # pfctl -t test -T add 198.51.100.81 > > 1 table created. > > 1/1 addresses added. > > > > # pfctl -t test -T show > > 198.51.100.81 > > > > # pfctl -t test -vT show > > 198.51.100.81 > > Cleared: Sat Feb 25 22:57:50 2017 > > > > # sysctl kern.securelevel=2 > > kern.securelevel: 1 -> 2 > > > > # pfctl -t test -T show > > pfctl: Operation not permitted. > > > > # pfctl -t test -vT show > > 198.51.100.81 > > Cleared: Sat Feb 25 22:57:50 2017 > > In addition to DIOCRGETASTATS, permit DIOCRGETADDRS if securelevel > 1. > > Index: sys/net/pf_ioctl.c > =================================================================== > RCS file: /cvs/src/sys/net/pf_ioctl.c,v > retrieving revision 1.307 > diff -u -p -r1.307 pf_ioctl.c > --- sys/net/pf_ioctl.c 30 Jan 2017 17:41:34 -0000 1.307 > +++ sys/net/pf_ioctl.c 28 Feb 2017 05:21:15 -0000 > @@ -917,6 +917,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t a > case DIOCRADDADDRS: > case DIOCRDELADDRS: > case DIOCRSETADDRS: > + case DIOCRGETADDRS: > case DIOCRGETASTATS: > case DIOCRCLRASTATS: > case DIOCRTSTADDRS: >
It was nearly 20 years ago that there were believers in securelevel 2. I was never one of them. However, the whole point was that securelevel 2 doesn't let you do a whole ton of things. That switch table was essentially complete two decades ago, and we don't know who is relying upon the behaviour now. I suggest you adapt.
