Re: SELinux Networking Enhancements

[Paul Moore <paul.moore@hp.com>]

Christopher J. PeBenito wrote:
> On Wed, 2006-11-01 at 09:58 -0600, Venkat Yekkirala wrote:
>
>>allow apache_t mozilla_t:association { recvfrom };
>>allow apache_t self:association { sendto };
>>
>>with the client having the following rules:
>>
>>allow mozilla_t apache_t:association { recvfrom };
>>allow mozilla_t self:association { sendto };
>  
> This doesn't cut it because you have no control who you are sending to.

Now, this would only work for connected stream sockets, but I imagine you could
always do an access check against the peer's context which you could obtain
using a process similar to getpeercon().

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.