[lkml]   [2009]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] Security: Add prctl(PR_{GET,SET}_NETWORK) interface.
    Stephen Hemminger  wrote:
    >Michael Stone <> wrote:
    >> 5. Linux today has pretty good support for controlling the creation of
    >> channels involving the filesystem and involving shared daemons. It has
    >> mediocre support for access control involving sysv-ipc
    >mechanisms. It has
    >> terrible support for access control involving non-local principals like
    >> "the collection of people and programs receiving packets sent to
    >> destination from source".
    >The policy control for this is done today on linux via the firewalling

    I don't know of any reasonable way to introduce firewall rules
    that apply only to a specific process; nor do I know of any way
    for a user-level (non-root) process to specify and apply such
    rules. So it doesn't sound to me like the firewalling infrastructure
    meets the requirements for which this patch was introduced. Or did
    I miss something?

     \ /
      Last update: 2009-12-19 13:05    [W:0.025 / U:1.516 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site