Can't access /dev/ip with ndd -get /dev/ip \?

Question

Hi all,
I am currently assesing the feasibility of running our software on Solaris 10 zones. I have run into a bit of a snag. The designers here tell me that the require the command ndd -get /dev/ip to work.
I have configured the zone with the device:
zonepath: /export/home/zone2
autoboot: true
pool:
inherit-pkg-dir:
        dir: /lib
inherit-pkg-dir:
        dir: /platform
inherit-pkg-dir:
        dir: /sbin
inherit-pkg-dir:
        dir: /usr
net:
        address: 47.135.214.77
        physical: bge0
device
        match: /dev/ipI am able to see /dev/ip in the zone
# ls -l /dev/ip
crw-rw-rw-   1 root     sys        3,  0 Jan 21 07:09 /dev/ipEverything looks good.
However, I cannot execute the command ndd
# ndd -get /dev/ip \?
open of /dev/ip failed: Permission denied
Is this expected behaviour or is there something that I should do to confgure this in the zone?
incidently, /dev/tcp is accessible from the zone:
# ndd -get /dev/tcp \?
?                             (read only)
tcp_time_wait_interval        (read and write)
tcp_conn_req_max_q            (read and write)
tcp_conn_req_max_q0           (read and write)
:Thanks,
Rich

Answer 1

Hello,
Yes a zone can't open /dev/ip because otherwise the zone could send handcrafted IP packets with the global zone's source address etc.
There are two workarounds:
- use <code>ndd -get /dev/arp {ip_ndd_variable}</code>
- replace the following line in /etc/security/device_policy :
<code>ip read_priv_set=net_rawaccess write_priv_set=net_rawaccess</code>
with:
<code>ip read_priv_set=net_icmpaccess write_priv_set=net_icmpaccess</code>
But beware, this one allows the zone to send rogue packets as described above.
Just being curious, which IP ndd variables do you want to look at from within the zone? We'd like to provide a better interface for applications to access those parameters.
Blaise