From: Stephen Hemminger <shemminger@linux-foundation.org>
To: Paul Moore <paul.moore@hp.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>,
linux-security-module@vger.kernel.org,
Al Viro <viro@zeniv.linux.org.uk>,
netdev@vger.kernel.org, James Morris <jmorris@namei.org>
Subject: Re: Real networking namespace
Date: Fri, 9 Oct 2009 19:08:20 -0700 [thread overview]
Message-ID: <20091009190820.0a0f09c2@nehalam> (raw)
In-Reply-To: <200910091812.16046.paul.moore@hp.com>
On Fri, 9 Oct 2009 18:12:15 -0400
Paul Moore <paul.moore@hp.com> wrote:
> On Friday 09 October 2009 12:44:52 pm Stephen Smalley wrote:
> > On Fri, 2009-10-09 at 12:37 -0400, Stephen Smalley wrote:
> > > On Fri, 2009-10-09 at 08:38 -0700, Stephen Hemminger wrote:
> > > > The existing networking namespace model is unattractive for what I
> > > > want, has anyone investigated better alternatives?
> > > >
> > > > I would like to be able to allow access to a network interface and
> > > > associated objects (routing tables etc), to be controlled by Mandatory
> > > > Access Control API's. I.e grant access to eth0 and to only certain
> > > > processes. Some the issues with the existing models are:
> > > > * eth0 and associated objects don't really exist in filesystem so
> > > > not subject to LSM style control (SeLinux/SMACK/TOMOYO)
>
> As Stephen points out, SELinux does have the ability to assign security labels
> to network interfaces, check out the 'semanage' command. A while back I wrote
> up something about the SELinux network "ingress/egress" access controls:
>
> * http://paulmoore.livejournal.com/2128.html
I was hoping to be able to not have inaccessible interfaces visible,
is it possible to not have interfaces show up in commands like:
ip link show
or sysfs?
--
next prev parent reply other threads:[~2009-10-10 2:08 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-10-09 15:38 Real networking namespace Stephen Hemminger
2009-10-09 16:37 ` Stephen Smalley
2009-10-09 16:44 ` Stephen Smalley
2009-10-09 22:12 ` Paul Moore
2009-10-10 2:08 ` Stephen Hemminger [this message]
2009-10-10 21:40 ` Paul Moore
2009-10-10 18:14 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20091009190820.0a0f09c2@nehalam \
--to=shemminger@linux-foundation.org \
--cc=jmorris@namei.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=paul.moore@hp.com \
--cc=sds@tycho.nsa.gov \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.