lkml.org 
[lkml]   [2009]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] Security: Add prctl(PR_{GET,SET}_NETWORK) interface.
Date
Stephen Hemminger  wrote:
>Michael Stone <michael@laptop.org> wrote:
>> 5. Linux today has pretty good support for controlling the creation of
>> channels involving the filesystem and involving shared daemons. It has
>> mediocre support for access control involving sysv-ipc
>mechanisms. It has
>> terrible support for access control involving non-local principals like
>> "the collection of people and programs receiving packets sent to
>> destination 18.0.0.1:80 from source 192.168.0.3:34661".
>
>The policy control for this is done today on linux via the firewalling
>infrastructure.

I don't know of any reasonable way to introduce firewall rules
that apply only to a specific process; nor do I know of any way
for a user-level (non-root) process to specify and apply such
rules. So it doesn't sound to me like the firewalling infrastructure
meets the requirements for which this patch was introduced. Or did
I miss something?


\
 
 \ /
  Last update: 2009-12-19 13:05    [from the cache]
©2003-2011 Jasper Spaans