Re: A new model for ports and kernel security?

James Morris
2003-10-01T19:27:59Z

On Wed, 1 Oct 2003, John Lange wrote:

> Suggestion: A groups based port binding security system for both
> outgoing and incoming port binding.

Something like this for port binding exists as an external patch:
http://www.olafdietsche.de/linux/accessfs/

> I realize similar things can be accomplished in other ways (with
> iptables I believe) but it just seems to me that this should be a
> fundamental part of the systems security and therefore should be in the
> kernel by default (just as the root binding to low ports is currently).

We should keep the standard behavior as default in the core kernel. Other
security models can be implemented via LSM, Netfilter, config options etc.

- James
--
James Morris
<jmorris@redhat.com>