Re: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4)

["Serge E. Hallyn" <serue@us.ibm.com>]

Quoting Michael Stone (michael@laptop.org):
> Quoting Michael Stone (michael@laptop.org):
> 
> >Ah - but I worry that if you do that Alan or others will object.  Where do
> >you plan to store the disablenet_allowed bit?
> 
> If using prctl directly, I would store the bit in the task->network bitfield
> introduced by the earlier patches.
> 
> >You can use security_prctl() to keep the code out of sys_prctl().
> 
> I don't understand this suggestion; can you clarify? (Also, for what it's
> worth: I intended to put the check for CAP_SETPCAP in prctl_set_network().)
> 
> >but you still have the question of whether you add a bit to the task struct,
> >use task->security and not stack with selinux, use a thread flag, or try to
> >enable stacking of task->security.
> 
> For this revision of the patch, I will use the same approach as the previous
> patches (conditionally compiled task->network).
> 
> Michael
> 
> P.S. - Patches to follow tonight or tomorrow.

Cool I'll just wait for the patches  :)

thanks,
-serge