lkml.org 
[lkml]   [2010]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4)
    On Mon 2010-01-11 08:11:55, James Morris wrote:
    > On Fri, 1 Jan 2010, Pavel Machek wrote:
    >
    > > > Quoting Michael Stone (michael@laptop.org):
    > > > > Implement security_* hooks for socket_create, socket_bind, socket_connect,
    > > > > socket_sendmsg, and ptrace_access_check which return -EPERM when called from a
    > > > > process with networking restrictions. Exempt AF_UNIX sockets.
    > > > >
    > > > > Signed-off-by: Michael Stone <michael@laptop.org>
    > > >
    > > > Acked-by: Serge Hallyn <serue@us.ibm.com>
    > >
    > > For the record: NAK, as it introduces security holes.
    >
    > Please elaborate.

    See the mailthread.

    Allows user to disable suid program's access to network. That bypasses
    audit, and will cause system-wide DoS if suid program decides to go
    daemon.
    Pavel
    --
    (english) http://www.livejournal.com/~pavelmachek
    (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


    \
     
     \ /
      Last update: 2010-01-10 22:19    [W:0.021 / U:32.524 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site