From: "Paul Moore" <paul.moore@hp.com>
To: shemminger@linux-foundation.org
Cc: sds@tycho.nsa.gov, linux-security-module@vger.kernel.org,
viro@zeniv.linux.org.uk, netdev@vger.kernel.org,
jmorris@namei.org
Subject: Re: Real networking namespace
Date: Sat, 10 Oct 2009 17:40:27 -0400 [thread overview]
Message-ID: <7264578776.939663627@hp.com> (raw)
In-Reply-To: <20091009190820.0a0f09c2@nehalam>
------- Original message -------
> From: Stephen Hemminger <shemminger@linux-foundation.org>
> Cc: sds@tycho.nsa.gov, linux-security-module@vger.kernel.org,
> viro@zeniv.linux.org.uk, netdev@vger.kernel.org, jmorris@namei.org
> Sent: 10/9, 22:08
>
> On Fri, 9 Oct 2009 18:12:15 -0400
> Paul Moore <paul.moore@hp.com> wrote:
>
>> On Friday 09 October 2009 12:44:52 pm Stephen Smalley wrote:
>> > On Fri, 2009-10-09 at 12:37 -0400, Stephen Smalley wrote:
>> > > On Fri, 2009-10-09 at 08:38 -0700, Stephen Hemminger wrote:
>> > > > The existing networking namespace model is unattractive for what I
>> > > > want, has anyone investigated better alternatives?
>> > > >
>> > > > I would like to be able to allow access to a network interface and
>> > > > associated objects (routing tables etc), to be controlled by
>> Mandatory
>> > > > Access Control API's. I.e grant access to eth0 and to only certain
>> > > > processes. Some the issues with the existing models are:
>> > > > * eth0 and associated objects don't really exist in filesystem
>> so
>> > > > not subject to LSM style control (SeLinux/SMACK/TOMOYO)
>>
>> As Stephen points out, SELinux does have the ability to assign security
>> labels
>> to network interfaces, check out the 'semanage' command. A while back I
>> wrote
>> up something about the SELinux network "ingress/egress" access controls:
>>
>> * http://paulmoore.livejournal.com/2128.html
>
> I was hoping to be able to not have inaccessible interfaces visible,
> is it possible to not have interfaces show up in commands like:
> ip link show
> or sysfs?
I haven't looked at the code for 'ip' but I'm pretty sure it uses netlink
to configure the kernel, yes? If that is the case, no I don't believe any
of the current LSMs provide that level of granularity (netlink, generic
netlink in particular, is a bit of a problem spot at the moment). As for
sysfs, I don't believe we label the interface related files based on their
semanage labels but I could be wrong - we've got plenty of good people
already working on fs labeling so I spend most of my time worrying about
network labeling.
--
paul moore
linux @ hp
next prev parent reply other threads:[~2009-10-10 21:40 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-10-09 15:38 Real networking namespace Stephen Hemminger
2009-10-09 16:37 ` Stephen Smalley
2009-10-09 16:44 ` Stephen Smalley
2009-10-09 22:12 ` Paul Moore
2009-10-10 2:08 ` Stephen Hemminger
2009-10-10 21:40 ` Paul Moore [this message]
2009-10-10 18:14 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7264578776.939663627@hp.com \
--to=paul.moore@hp.com \
--cc=jmorris@namei.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=shemminger@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.