9 # security.mac.portacl.suser_exempt value doesn't affect unprivileged users
11 # mac_portacl has no impact on ports <= net.inet.ip.portrange.reservedhigh.
13 trap restore_settings EXIT INT TERM
15 sysctl security.mac.portacl.suser_exempt=1 >/dev/null
16 sysctl net.inet.ip.portrange.reservedhigh=78 >/dev/null
18 bind_test fl fl uid nobody tcp 77
19 bind_test ok ok uid nobody tcp 7777
20 bind_test fl fl uid nobody udp 77
21 bind_test ok ok uid nobody udp 7777
23 bind_test fl fl gid nobody tcp 77
24 bind_test ok ok gid nobody tcp 7777
25 bind_test fl fl gid nobody udp 77
26 bind_test ok ok gid nobody udp 7777
28 sysctl security.mac.portacl.suser_exempt=0 >/dev/null
30 bind_test fl fl uid nobody tcp 77
31 bind_test ok ok uid nobody tcp 7777
32 bind_test fl fl uid nobody udp 77
33 bind_test ok ok uid nobody udp 7777
35 bind_test fl fl gid nobody tcp 77
36 bind_test ok ok gid nobody tcp 7777
37 bind_test fl fl gid nobody udp 77
38 bind_test ok ok gid nobody udp 7777
40 # Verify if security.mac.portacl.port_high works.
42 sysctl security.mac.portacl.port_high=7778 >/dev/null
44 bind_test fl fl uid nobody tcp 77
45 bind_test fl ok uid nobody tcp 7777
46 bind_test fl fl uid nobody udp 77
47 bind_test fl ok uid nobody udp 7777
49 bind_test fl fl gid nobody tcp 77
50 bind_test fl ok gid nobody tcp 7777
51 bind_test fl fl gid nobody udp 77
52 bind_test fl ok gid nobody udp 7777
54 # Verify if mac_portacl rules work.
56 sysctl net.inet.ip.portrange.reservedhigh=76 >/dev/null
57 sysctl security.mac.portacl.port_high=7776 >/dev/null
59 bind_test fl ok uid nobody tcp 77
60 bind_test ok ok uid nobody tcp 7777
61 bind_test fl ok uid nobody udp 77
62 bind_test ok ok uid nobody udp 7777
64 bind_test fl ok gid nobody tcp 77
65 bind_test ok ok gid nobody tcp 7777
66 bind_test fl ok gid nobody udp 77
67 bind_test ok ok gid nobody udp 7777