From: John Wood <john.wood@gmx.com>
To: Jeffrey Walton <noloader@gmail.com>,
kernelnewbies <kernelnewbies@kernelnewbies.org>
Cc: John Wood <john.wood@gmx.com>
Subject: Re: Test if a socket accept is from external network
Date: Sun, 25 Apr 2021 15:34:30 +0200 [thread overview]
Message-ID: <20210425133430.GA3407@ubuntu> (raw)
In-Reply-To: <CAH8yC8kiud9BK89i0R4ycQ2QTddC_pWi+vRp6sGUcxiOJuoLZw@mail.gmail.com>
Hi,
On Sun, Apr 25, 2021 at 08:01:55AM -0400, Jeffrey Walton wrote:
> On Sun, Apr 25, 2021 at 7:09 AM John Wood <john.wood@gmx.com> wrote:
> >
> > I'm working in a LSM to detect and mitigate fork brute force attacks
> > against vulnerable userspace applications. Now, to fine tuning the
> > detection I want to detect a network activity. ...
> > How can I detect that an external connection (using a net device) is
> > accepted and avoid internal network communication?
>
> One caveat that may (or may not) apply...
>
> Systemd opens sockets for services even when a service is disabled. It
> could appear that a system is accepting traffic even when the service
> is unavailable.
But if the service is unavailable it will not accept connections. I hope.
If we use the socket_accept LSM hook it will not be called under this
scenario.
John Wood
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
next prev parent reply other threads:[~2021-04-25 13:35 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-25 11:08 Test if a socket accept is from external network John Wood
2021-04-25 12:01 ` Jeffrey Walton
2021-04-25 13:34 ` John Wood [this message]
2021-05-05 1:39 ` jim.cromie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210425133430.GA3407@ubuntu \
--to=john.wood@gmx.com \
--cc=kernelnewbies@kernelnewbies.org \
--cc=noloader@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).