Messages in this thread |  | | | From | (David Wagner) | | Subject | Re: [PATCH] Security: Add prctl(PR_{GET,SET}_NETWORK) interface. | | Date | Sat, 19 Dec 2009 12:02:05 +0000 (UTC) |
| |
Stephen Hemminger wrote: >Michael Stone <michael@laptop.org> wrote: >> 5. Linux today has pretty good support for controlling the creation of >> channels involving the filesystem and involving shared daemons. It has >> mediocre support for access control involving sysv-ipc >mechanisms. It has >> terrible support for access control involving non-local principals like >> "the collection of people and programs receiving packets sent to >> destination 18.0.0.1:80 from source 192.168.0.3:34661". > >The policy control for this is done today on linux via the firewalling >infrastructure.
I don't know of any reasonable way to introduce firewall rules that apply only to a specific process; nor do I know of any way for a user-level (non-root) process to specify and apply such rules. So it doesn't sound to me like the firewalling infrastructure meets the requirements for which this patch was introduced. Or did I miss something?
|  |