lkml.org 
[lkml]   [2010]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: disablenetwork (v5) patches
    On Fri, Jan 15, 2010 at 03:10, Michael Stone <michael@laptop.org> wrote:
    > As promised, here are patches implementing and documenting a CAP_SETPCAP-gated
    > "enable" bit along with a couple of other tweaks discussed earlier in the
    > thread. For ease of development and review, the following four patches
    > extend the disablenetwork (v4) patch series rather than replacing it.

    To be honest, I'm still not convinced that this is the right way to
    approach your problem. I think you would be much better off with
    something analogous to the stripped-down SELinux policy I sent in an
    earlier email (150 lines, give or take). By using the appropriate
    SELinux hooks you can obtain the *exact* same enforcement, but without
    adding any code to the kernel.

    I have some time this week to split out my SELinux policy build
    machinery; I will pull out a standalone set of files to build the
    policy and do some extra testing on one of my bog-standard Debian
    boxes and then send it all out again.

    Cheers,
    Kyle Moffett


    \
     
     \ /
      Last update: 2010-01-17 07:11    [W:0.023 / U:34.680 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site