lkml.org 
[lkml]   [2010]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4)
    Quoting Michael Stone (michael@laptop.org):
    > Quoting Michael Stone (michael@laptop.org):
    >
    > >Ah - but I worry that if you do that Alan or others will object. Where do
    > >you plan to store the disablenet_allowed bit?
    >
    > If using prctl directly, I would store the bit in the task->network bitfield
    > introduced by the earlier patches.
    >
    > >You can use security_prctl() to keep the code out of sys_prctl().
    >
    > I don't understand this suggestion; can you clarify? (Also, for what it's
    > worth: I intended to put the check for CAP_SETPCAP in prctl_set_network().)
    >
    > >but you still have the question of whether you add a bit to the task struct,
    > >use task->security and not stack with selinux, use a thread flag, or try to
    > >enable stacking of task->security.
    >
    > For this revision of the patch, I will use the same approach as the previous
    > patches (conditionally compiled task->network).
    >
    > Michael
    >
    > P.S. - Patches to follow tonight or tomorrow.

    Cool I'll just wait for the patches :)

    thanks,
    -serge


    \
     
     \ /
      Last update: 2010-01-14 18:39    [W:0.038 / U:31.816 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site