[lkml]   [2010]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4)
Quoting Michael Stone (
> Quoting Michael Stone (
> >Ah - but I worry that if you do that Alan or others will object. Where do
> >you plan to store the disablenet_allowed bit?
> If using prctl directly, I would store the bit in the task->network bitfield
> introduced by the earlier patches.
> >You can use security_prctl() to keep the code out of sys_prctl().
> I don't understand this suggestion; can you clarify? (Also, for what it's
> worth: I intended to put the check for CAP_SETPCAP in prctl_set_network().)
> >but you still have the question of whether you add a bit to the task struct,
> >use task->security and not stack with selinux, use a thread flag, or try to
> >enable stacking of task->security.
> For this revision of the patch, I will use the same approach as the previous
> patches (conditionally compiled task->network).
> Michael
> P.S. - Patches to follow tonight or tomorrow.

Cool I'll just wait for the patches :)


 \ /
  Last update: 2010-01-14 18:39    [W:0.170 / U:3.988 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site