lkml.org 
[lkml]   [1996]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Ideas for v2.1
From
Date
Alan Cox writes:
> Its often hard to tell who exactly owns which service, and many
> local services have agents that then go and query remote hosts. It
> is doable for protocols, the AX.25 protocol does it so you can have
> both radio amateur's and non licensed users on the same machine. It
> does not do it for IP however as its far more complex.

I'm not sure what you mean by "hard to tell who owns which service".
Every time you send a datagram, it goes through the networking code in
the kernel, which knows your UID, your GID, and your groups list. It
also knows the destination address and port. It is rather simple to
insert code which matches the address and port against a set of ACLs,
and then looks for the user in the ACL if it finds one.

(Hmm, I wonder if the folks working on the e2fs ACL support are going
to do it properly and provide an ACL module, so that any other kernel
object can use their ACL implementation for access control.)

-Marc


\
 
 \ /
  Last update: 2005-03-22 13:37    [W:2.221 / U:0.004 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site