Re: gpart strangeness

2018-08-20 Thread Eugene Grosbein
21.08.2018 2:15, Mike Tancsa wrote:

> I was trying to create a single partition on a 16G mSata drive and
> whenever I add a partition, all of a sudden the secondary GPT partion is
> borked.  Any idea whats going on here ?
> 
> 
> 
> 0# gpart destroy -F ada0
> ada0 destroyed
> 0# gpart create -s GPT ada0
> ada0 created
> 0# gpart add -t freebsd-ufs ada0
> GEOM: diskid/DISK-DEF30753136101678326: the secondary GPT table is
> corrupt or invalid.
> GEOM: diskid/DISK-DEF30753136101678326: using the primary only --
> recovery suggested.
> ada0p1 added
> 0# gpart list ada0
> Geom name: ada0
> modified: false
> state: OK
> fwheads: 16
> fwsectors: 63
> last: 31277191
> first: 40
> entries: 128
> scheme: GPT
> Providers:
> 1. Name: ada0p1
>Mediasize: 16013901824 (15G)
>Sectorsize: 512
>Stripesize: 0
>Stripeoffset: 20480
>Mode: r0w0e0
>efimedia: HD(1,GPT,2256d7c5-a4ad-11e8-aa7c-000db94b5a84,0x28,0x1dd4060)
>rawuuid: 2256d7c5-a4ad-11e8-aa7c-000db94b5a84
>rawtype: 516e7cb6-6ecf-11d6-8ff8-00022d09712b
>label: (null)
>length: 16013901824
>offset: 20480
>type: freebsd-ufs
>index: 1
>end: 31277191
>start: 40
> Consumers:
> 1. Name: ada0
>Mediasize: 16013942784 (15G)
>Sectorsize: 512
>Mode: r0w0e0
> 
> 0#

Did you look to "dmesg -a" output for additional hints?
What is system version?
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Eugene Grosbein
21.08.2018 1:37, Charles Sprickman via freebsd-stable wrote:

> I am so behind on all the new toys in the system.  I was very embarrassed
> to find out about this feature from someone who’s primarily working
> with Linux in his day job.  He was just looking to bind an Elixir app to 
> 80/443
> without running as root and he shared this:
> 
> security.mac.portacl.rules=gid:2001:tcp:80,gid:2001:tcp:443
> 
> We stuck that in sysctl.conf and that was that.

This is not so new: mac_portacl is here since 8.0-RELEASE.

> I wish FreeBSD still had the evangelism folks that would go out and
> tell the userbase and anyone else that would listen about all the cool
> new stuff. :)

Well, we still have Release Notes for every major or minor release.
Get a habit reading it once a release and you'll know it all.

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: changes in iostat output in 11.x vs 10.x

2018-08-20 Thread Miroslav Lachman

Will Andrews wrote on 2018/08/20 15:33:

On Sun, Aug 19, 2018 at 9:30 AM, John-Mark Gurney  wrote:


Miroslav Lachman wrote this message on Sun, Aug 19, 2018 at 02:29 +0200:

I upgraded one of our servers from 10.4 to 11.2 and scripts using output
of "iostat -x" are not working anymore.
A checked the output of iostat and it is different.


Looks like this was changed in r277566[1] by will.  I've cc'd him.  There
is no documentation change associated w/ this change.

[1] https://svnweb.freebsd.org/base?view=revision=277566



Ah, yes, that should have been accompanied by a man page update.  My bad,
I'll fix it.  ms/t is indeed what used to be svc_t.


Thank you for the clarification.

Kind regards
Miroslav Lachman
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


gpart strangeness

2018-08-20 Thread Mike Tancsa
I was trying to create a single partition on a 16G mSata drive and
whenever I add a partition, all of a sudden the secondary GPT partion is
borked.  Any idea whats going on here ?



0# gpart destroy -F ada0
ada0 destroyed
0# gpart create -s GPT ada0
ada0 created
0# gpart add -t freebsd-ufs ada0
GEOM: diskid/DISK-DEF30753136101678326: the secondary GPT table is
corrupt or invalid.
GEOM: diskid/DISK-DEF30753136101678326: using the primary only --
recovery suggested.
ada0p1 added
0# gpart list ada0
Geom name: ada0
modified: false
state: OK
fwheads: 16
fwsectors: 63
last: 31277191
first: 40
entries: 128
scheme: GPT
Providers:
1. Name: ada0p1
   Mediasize: 16013901824 (15G)
   Sectorsize: 512
   Stripesize: 0
   Stripeoffset: 20480
   Mode: r0w0e0
   efimedia: HD(1,GPT,2256d7c5-a4ad-11e8-aa7c-000db94b5a84,0x28,0x1dd4060)
   rawuuid: 2256d7c5-a4ad-11e8-aa7c-000db94b5a84
   rawtype: 516e7cb6-6ecf-11d6-8ff8-00022d09712b
   label: (null)
   length: 16013901824
   offset: 20480
   type: freebsd-ufs
   index: 1
   end: 31277191
   start: 40
Consumers:
1. Name: ada0
   Mediasize: 16013942784 (15G)
   Sectorsize: 512
   Mode: r0w0e0

0#

-- 
---
Mike Tancsa, tel +1 519 651 3400 x203
Sentex Communications, m...@sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Charles Sprickman via freebsd-stable

> On Aug 20, 2018, at 11:04 AM, Ian Lepore  wrote:
> 
> On Mon, 2018-08-20 at 16:47 +0200, Stefan Bethke wrote:
>> I have a Go program (acme-dns) that wants to bind 53, 80, and 443,
>> and I´d rather have it run as a non-privileged user.  The program
>> doesn´t provide a facility to drop privs after binding the ports. I´m
>> planning to run it in a jail.
>> 
>> After some googling, it appears that a couple of years ago I should
>> have been able to do:
>> sysctl net.inet.ip.portrange.reservedhigh=0
>> and allow all processes to bind to „low“ ports. This does not work in
>> my jails on a 11-stable host.
>> 
>> $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
>> net.inet.ip.portrange.reservedhigh: 1023
>> sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted
>> 
>> Securelevel should not interfere:
>> $ sysctl kern.securelevel
>> kern.securelevel: -1
>> 
>> Is there a way to allow regular processes to bind to low ports?
>> 
>> 
>> Stefan
>> 
> 
> You might be able to set up a specific local userid for this process,
> then use mac_portacl(4) to allow it to bind to those ports. I'm not
> certain that works inside a jail, however.

I am so behind on all the new toys in the system.  I was very embarrassed
to find out about this feature from someone who’s primarily working
with Linux in his day job.  He was just looking to bind an Elixir app to 80/443
without running as root and he shared this:

security.mac.portacl.rules=gid:2001:tcp:80,gid:2001:tcp:443

We stuck that in sysctl.conf and that was that.

I wish FreeBSD still had the evangelism folks that would go out and
tell the userbase and anyone else that would listen about all the cool
new stuff. :)

Charles

> 
> -- Ian
> ___
> freebsd-stable@freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Stefan Bethke


> Am 20.08.2018 um 18:32 schrieb Bjoern A. Zeeb 
> :
> 
> On 20 Aug 2018, at 16:22, Stefan Bethke wrote:
> 
 Is there a way to allow regular processes to bind to low ports?
>>> 
>>> you have to set it on the base system;  alternatively with vnet you might 
>>> be able to change it per-jail.
>> 
>> Do you feel it’s OK to enable VIMAGE in -stable? When I tried last in 2016, 
>> I had stability issues, I think related to pf.
> 
> “If you know what you are doing it won’t panic” ;-)   I think with 12 I’d be 
> a lot more confident about stability.  Most fixes could not and were not 
> MFCed.

OK then, should I move to -current and try there? I’ve not tracked -current on 
a production box in years (I think the last time was around 3 or 4), but I’m 
willing to give it a go, seeing that the code freeze is about to start.


Stefan

-- 
Stefan BethkeFon +49 151 14070811

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Eugene Grosbein
20.08.2018 23:22, Stefan Bethke wrote:

> Do you feel it’s OK to enable VIMAGE in -stable? When I tried last in 2016, I 
> had stability issues, I think related to pf.

It is already in HEAD's GENERIC and will be in 12.0-RELEASE soon, so in -stable 
too.

I use it with stable/11 without problems but I do not use pf.

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Bjoern A. Zeeb

On 20 Aug 2018, at 16:22, Stefan Bethke wrote:


Is there a way to allow regular processes to bind to low ports?


you have to set it on the base system;  alternatively with vnet you 
might be able to change it per-jail.


Do you feel it’s OK to enable VIMAGE in -stable? When I tried last 
in 2016, I had stability issues, I think related to pf.


“If you know what you are doing it won’t panic” ;-)   I think with 
12 I’d be a lot more confident about stability.  Most fixes could not 
and were not MFCed.


/bz
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Stefan Bethke


> Am 20.08.2018 um 16:59 schrieb Bjoern A. Zeeb 
> :
> 
> On 20 Aug 2018, at 14:47, Stefan Bethke wrote:
> 
>> I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and I’d 
>> rather have it run as a non-privileged user.  The program doesn’t provide a 
>> facility to drop privs after binding the ports. I’m planning to run it in a 
>> jail.
>> 
>> After some googling, it appears that a couple of years ago I should have 
>> been able to do:
>> sysctl net.inet.ip.portrange.reservedhigh=0
>> and allow all processes to bind to „low“ ports. This does not work in my 
>> jails on a 11-stable host.
>> 
>> $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
>> net.inet.ip.portrange.reservedhigh: 1023
>> sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted
>> 
>> Securelevel should not interfere:
>> $ sysctl kern.securelevel
>> kern.securelevel: -1
>> 
>> Is there a way to allow regular processes to bind to low ports?
> 
> you have to set it on the base system;  alternatively with vnet you might be 
> able to change it per-jail.

Do you feel it’s OK to enable VIMAGE in -stable? When I tried last in 2016, I 
had stability issues, I think related to pf.


Stefan

-- 
Stefan BethkeFon +49 151 14070811

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Portas Abertas SENAI | Porto Alegre | 25 de agosto

2018-08-20 Thread Sistema FIERGS | SENAI-RS


___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Eugene Grosbein
20.08.2018 22:02, Stefan Bethke wrote:

>> The trick is that mac_portacl provides a way to selectively give permission 
>> for non-root UID
>> to bind low ports:
>>
>> security.mac.portacl.rules=uid:88:tcp:80,uid:88:tcp:443,uid:53:tcp:53,uid:53:udp:53
>>
>> It works just fine for a host and I use it for name servers utilizing port 53
>> for a box with dynamically created interfaces, so it may bind the port for 
>> distinct IP addresses
>> after it dropped privilegies when new interface is created and get new IP 
>> assigned.
>>
>> I have not tried it for a jails, though. Please try and respond.
> 
> Thanks, but do I understand correctly that the security.mac.portacl.rules are 
> system-wide and not per-jail?

It seems so. It is small kernel module and it should not be so hard to make it 
VNET-aware
for one already familiar with the code. You may want to fill a PR for that,
so it would became possible to have per-jail settings for VIMAGE-enabled jails.



___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Ian Lepore
On Mon, 2018-08-20 at 17:02 +0200, Stefan Bethke wrote:
> Am 20.08.2018 um 16:59 schrieb Eugene Grosbein :
> > 
> > 
> > 20.08.2018 21:47, Stefan Bethke wrote:
> > 
> > > 
> > > I have a Go program (acme-dns) that wants to bind 53, 80, and
> > > 443, and I’d rather have it run as a non-privileged user.  The
> > > program doesn’t provide a facility to drop privs after binding
> > > the ports. I’m planning to run it in a jail.
> > > 
> > > After some googling, it appears that a couple of years ago I
> > > should have been able to do:
> > > sysctl net.inet.ip.portrange.reservedhigh=0
> > > and allow all processes to bind to „low“ ports. This does not
> > > work in my jails on a 11-stable host.
> > > 
> > > $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
> > > net.inet.ip.portrange.reservedhigh: 1023
> > > sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not
> > > permitted
> > > 
> > > Securelevel should not interfere:
> > > $ sysctl kern.securelevel
> > > kern.securelevel: -1
> > > 
> > > Is there a way to allow regular processes to bind to low ports?
> > Yes. Just use mac_portacl kernel module: kldload mac_portacl
> > 
> > Once loaded, it duplicates net.inet.ip.portrange.reservedhigh
> > protection
> > with its own security.mac.portacl.port_high, so it's safe to
> > disable
> > "reservedhigh" for whole system by running sysctl
> > net.inet.ip.portrange.reservedhigh=0
> > for host.
> > 
> > The trick is that mac_portacl provides a way to selectively give
> > permission for non-root UID
> > to bind low ports:
> > 
> > security.mac.portacl.rules=uid:88:tcp:80,uid:88:tcp:443,uid:53:tcp:
> > 53,uid:53:udp:53
> > 
> > It works just fine for a host and I use it for name servers
> > utilizing port 53
> > for a box with dynamically created interfaces, so it may bind the
> > port for distinct IP addresses
> > after it dropped privilegies when new interface is created and get
> > new IP assigned.
> > 
> > I have not tried it for a jails, though. Please try and respond.
> Thanks, but do I understand correctly that the
> security.mac.portacl.rules are system-wide and not per-jail?
> 
> I’m running ~10 jails on this host, and I don’t want to allow all of
> them to bind to low ports.
> 

Portacls are configure by userid. Just create a local userid that is
dedicated to this one process that runs in the one jail, and only it
(and root of course) would be able to bind to those ports.

-- Ian

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Eugene Grosbein
20.08.2018 21:47, Stefan Bethke wrote:

> I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and I’d 
> rather have it run as a non-privileged user.  The program doesn’t provide a 
> facility to drop privs after binding the ports. I’m planning to run it in a 
> jail.
> 
> After some googling, it appears that a couple of years ago I should have been 
> able to do:
> sysctl net.inet.ip.portrange.reservedhigh=0
> and allow all processes to bind to „low“ ports. This does not work in my 
> jails on a 11-stable host.
> 
> $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
> net.inet.ip.portrange.reservedhigh: 1023
> sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted
> 
> Securelevel should not interfere:
> $ sysctl kern.securelevel
> kern.securelevel: -1
> 
> Is there a way to allow regular processes to bind to low ports?

Yes. Just use mac_portacl kernel module: kldload mac_portacl

Once loaded, it duplicates net.inet.ip.portrange.reservedhigh protection
with its own security.mac.portacl.port_high, so it's safe to disable
"reservedhigh" for whole system by running sysctl 
net.inet.ip.portrange.reservedhigh=0
for host.

The trick is that mac_portacl provides a way to selectively give permission for 
non-root UID
to bind low ports:

security.mac.portacl.rules=uid:88:tcp:80,uid:88:tcp:443,uid:53:tcp:53,uid:53:udp:53

It works just fine for a host and I use it for name servers utilizing port 53
for a box with dynamically created interfaces, so it may bind the port for 
distinct IP addresses
after it dropped privilegies when new interface is created and get new IP 
assigned.

I have not tried it for a jails, though. Please try and respond.


___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Ian Lepore
On Mon, 2018-08-20 at 16:47 +0200, Stefan Bethke wrote:
> I have a Go program (acme-dns) that wants to bind 53, 80, and 443,
> and I’d rather have it run as a non-privileged user.  The program
> doesn’t provide a facility to drop privs after binding the ports. I’m
> planning to run it in a jail.
> 
> After some googling, it appears that a couple of years ago I should
> have been able to do:
> sysctl net.inet.ip.portrange.reservedhigh=0
> and allow all processes to bind to „low“ ports. This does not work in
> my jails on a 11-stable host.
> 
> $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
> net.inet.ip.portrange.reservedhigh: 1023
> sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted
> 
> Securelevel should not interfere:
> $ sysctl kern.securelevel
> kern.securelevel: -1
> 
> Is there a way to allow regular processes to bind to low ports?
> 
> 
> Stefan
> 

You might be able to set up a specific local userid for this process,
then use mac_portacl(4) to allow it to bind to those ports. I'm not
certain that works inside a jail, however.

-- Ian
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Stefan Bethke
Am 20.08.2018 um 16:59 schrieb Eugene Grosbein :
> 
> 20.08.2018 21:47, Stefan Bethke wrote:
> 
>> I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and I’d 
>> rather have it run as a non-privileged user.  The program doesn’t provide a 
>> facility to drop privs after binding the ports. I’m planning to run it in a 
>> jail.
>> 
>> After some googling, it appears that a couple of years ago I should have 
>> been able to do:
>> sysctl net.inet.ip.portrange.reservedhigh=0
>> and allow all processes to bind to „low“ ports. This does not work in my 
>> jails on a 11-stable host.
>> 
>> $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
>> net.inet.ip.portrange.reservedhigh: 1023
>> sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted
>> 
>> Securelevel should not interfere:
>> $ sysctl kern.securelevel
>> kern.securelevel: -1
>> 
>> Is there a way to allow regular processes to bind to low ports?
> 
> Yes. Just use mac_portacl kernel module: kldload mac_portacl
> 
> Once loaded, it duplicates net.inet.ip.portrange.reservedhigh protection
> with its own security.mac.portacl.port_high, so it's safe to disable
> "reservedhigh" for whole system by running sysctl 
> net.inet.ip.portrange.reservedhigh=0
> for host.
> 
> The trick is that mac_portacl provides a way to selectively give permission 
> for non-root UID
> to bind low ports:
> 
> security.mac.portacl.rules=uid:88:tcp:80,uid:88:tcp:443,uid:53:tcp:53,uid:53:udp:53
> 
> It works just fine for a host and I use it for name servers utilizing port 53
> for a box with dynamically created interfaces, so it may bind the port for 
> distinct IP addresses
> after it dropped privilegies when new interface is created and get new IP 
> assigned.
> 
> I have not tried it for a jails, though. Please try and respond.

Thanks, but do I understand correctly that the security.mac.portacl.rules are 
system-wide and not per-jail?

I’m running ~10 jails on this host, and I don’t want to allow all of them to 
bind to low ports.


Stefan

-- 
Stefan BethkeFon +49 151 14070811

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: Bind to port <1024 in jail

2018-08-20 Thread Bjoern A. Zeeb

On 20 Aug 2018, at 14:47, Stefan Bethke wrote:

I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and 
I’d rather have it run as a non-privileged user.  The program 
doesn’t provide a facility to drop privs after binding the ports. 
I’m planning to run it in a jail.


After some googling, it appears that a couple of years ago I should 
have been able to do:

sysctl net.inet.ip.portrange.reservedhigh=0
and allow all processes to bind to „low“ ports. This does not work 
in my jails on a 11-stable host.


$ sudo sysctl net.inet.ip.portrange.reservedhigh=0
net.inet.ip.portrange.reservedhigh: 1023
sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted

Securelevel should not interfere:
$ sysctl kern.securelevel
kern.securelevel: -1

Is there a way to allow regular processes to bind to low ports?


you have to set it on the base system;  alternatively with vnet you 
might be able to change it per-jail.


/bz
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Bind to port <1024 in jail

2018-08-20 Thread Stefan Bethke
I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and I’d 
rather have it run as a non-privileged user.  The program doesn’t provide a 
facility to drop privs after binding the ports. I’m planning to run it in a 
jail.

After some googling, it appears that a couple of years ago I should have been 
able to do:
sysctl net.inet.ip.portrange.reservedhigh=0
and allow all processes to bind to „low“ ports. This does not work in my jails 
on a 11-stable host.

$ sudo sysctl net.inet.ip.portrange.reservedhigh=0
net.inet.ip.portrange.reservedhigh: 1023
sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted

Securelevel should not interfere:
$ sysctl kern.securelevel
kern.securelevel: -1

Is there a way to allow regular processes to bind to low ports?


Stefan

-- 
Stefan BethkeFon +49 151 14070811

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: VNET related kernel panic on jail startup with epairs on 11-STABLE

2018-08-20 Thread Oliver Pinter
On 8/3/18, Bjoern A. Zeeb  wrote:
> On 3 Aug 2018, at 20:42, Oliver Pinter wrote:
>
>> On 8/3/18, Bjoern A. Zeeb  wrote:
>>> On 3 Aug 2018, at 18:48, Oliver Pinter wrote:
>>>
 Hi all!

 One of out users observed an VNET related kernel panic with epairs
 in
 a jail. Seems like some of the
>>>
>>> Well would be great for a start to (a) email virtualisation@ as well,
>>> (b) include a panic message, backtrace or other related information
>>> to
>>> deduce anything about the possible bug, (c) and not to conflate it
>>> with
>>> another totally unrelated MFC request.
>>>
>>> So what makes you think it’s related to tcp fast open?
>>
>> Every required detail is in HardenedBSD's github issue, but I copy the
>> kernel panic here:
>
> Ah sorry my bad;  the issue said ZFS in the subject and I thought it
> refers to something else.
>
> Thanks! Looking at the backtrace it seems it is happening on teardown
> and not on startup but indeed in the fast open code and that PR 216613
> indeed fixed this in head, good :)  Hope Patrick will do the mfc for
> you.

Hi!

Could you please you or Patrick MFC the above commits?

>
> /bz
>
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Truck Owners List

2018-08-20 Thread Diana Daniels



Hi,

Greeting of the day!

Would you be interested in acquiring an email list of "Truck Owners" from USA?

We also have data for Cruise Travelers, Boat Owners, Travelers List, RV Owners 
List, Spa and Resorts List, Scuba Divers List, Fishing Enthusiasts List, 
Apparel Buyers, Luxury Brand Buyers, Gift buyers and many more.

Each record in the list contains Contact Name (First and Last Name), Mailing 
Address, List type and Opt-in email address.

All the contacts are opt-in verified,complete permission based and can be used 
for unlimited multi-channel marketing.

Let me know if you'd be interested in hearing more information about it.

Waiting for your valuable and sincere reply.

Best Regards,
Diana Daniels
Research Analyst

___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"


Re: changes in iostat output in 11.x vs 10.x

2018-08-20 Thread Will Andrews
On Sun, Aug 19, 2018 at 9:30 AM, John-Mark Gurney  wrote:

> Miroslav Lachman wrote this message on Sun, Aug 19, 2018 at 02:29 +0200:
> > I upgraded one of our servers from 10.4 to 11.2 and scripts using output
> > of "iostat -x" are not working anymore.
> > A checked the output of iostat and it is different.
>
> Looks like this was changed in r277566[1] by will.  I've cc'd him.  There
> is no documentation change associated w/ this change.
>
> [1] https://svnweb.freebsd.org/base?view=revision=277566


Ah, yes, that should have been accompanied by a man page update.  My bad,
I'll fix it.  ms/t is indeed what used to be svc_t.

--Will.
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"