[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

RE: Limiting IPC with SELinux?



On Mon, 25 Apr 2005, Stephen Smalley wrote:

> Actually, Thomas Bleher's suggestion of extending the ipt owner module
> might be better.

The upstream module only works for outgoing packets, and also imposes some 
heavy locking.

For outgoing packets we already have the security context via the owning 
socket, and for incoming packets we probably need to hook sock_rcv_skb.

In any case, I didn't understand the idea of adding a permission for all 
matches, when the SELinux code doesn't understand why the packet was being 
matched or what is supposed to happen to it.


- James
-- 
James Morris
<jmorris redhat com>



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]