lkml.org 
[lkml]   [2010]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4)
Quoting Michael Stone (michael@laptop.org):
> Quoting Michael Stone (michael@laptop.org):
>
> >Ah - but I worry that if you do that Alan or others will object. Where do
> >you plan to store the disablenet_allowed bit?
>
> If using prctl directly, I would store the bit in the task->network bitfield
> introduced by the earlier patches.
>
> >You can use security_prctl() to keep the code out of sys_prctl().
>
> I don't understand this suggestion; can you clarify? (Also, for what it's
> worth: I intended to put the check for CAP_SETPCAP in prctl_set_network().)
>
> >but you still have the question of whether you add a bit to the task struct,
> >use task->security and not stack with selinux, use a thread flag, or try to
> >enable stacking of task->security.
>
> For this revision of the patch, I will use the same approach as the previous
> patches (conditionally compiled task->network).
>
> Michael
>
> P.S. - Patches to follow tonight or tomorrow.

Cool I'll just wait for the patches :)

thanks,
-serge


\
 
 \ /
  Last update: 2010-01-14 18:39    [from the cache]
©2003-2011 Jasper Spaans