[lkml]   [2009]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] Security: Implement and document RLIMIT_NETWORK.
Le mercredi 7 janvier 2009 13:47:03 Evgeniy Polyakov, vous avez écrit :
> The same goal can be achieved with 'owner' iptables match module btw.

Err no. iptables is _not_ suitable for userland applications dropping their
_own_ privileges. For privileged processes, it's clumsy at best, as iptables
does not quite work if more than one applications uses it. That's typically
your firewall configuration wizard or some custom admin-made script.
As for UNprivileged processes, iptables is not allowed.

As I understand it, Michael is trying to build something similar to SECCOMP,
only way less restrictive and way more usable by real-life userland programs.

Rémi Denis-Courmont
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2009-01-07 18:27    [W:0.096 / U:26.892 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site