From: Roberto De Ioris <roberto@unbit.it>
To: Gerhard Mack <gmack@innerfire.net>
Cc: linux-security-module@vger.kernel.org,
linux-kernel <linux-kernel@vger.kernel.org>
Subject: Re: [ANNOUNCE] UidBind LSM 0.2
Date: Wed, 25 Apr 2007 09:28:22 +0200 [thread overview]
Message-ID: <1177486102.25490.6.camel@hagrid> (raw)
In-Reply-To: <Pine.LNX.4.64.0704241809400.21879@mtl.rackplans.net>
[-- Attachment #1: Type: text/plain, Size: 1092 bytes --]
Il giorno mar, 24/04/2007 alle 18.11 -0400, Gerhard Mack ha scritto:
> On Tue, 24 Apr 2007, Casey Schaufler wrote:
>
> > --- Gerhard Mack <gmack@innerfire.net> wrote:
> > If you're daring you could propose that low number ports be treated
> > the same way as other ports, with the default ownership being root and
> > the default ACL allowing only root.
>
> ACL may be more complicated than needed when a simple GID addition would
> make this right about perfect.
The unix way(TM) for specifying multiple uid is...ehm.. groups :)
I will add the gid,tcp_gid and udp_gid configfs attributes in the next
release.
The 'check order' will be:
uidbind/<port>/<ip>/<proto>_uid
uidbind/<port>/<ip>/uid
uidbind/<port>/<proto>_uid
uidbind/<port>/uid
uidbind/<port>/<ip>/<proto>_gid
uidbind/<port>/<ip>/gid
uidbind/<port>/<proto>_gid
uidbind/<port>/gid
I am investigating the possibility of port-range use, particularly the
overlap checks and performance problems.
--
Roberto De Ioris
http://unbit.it
JID: roberto@jabber.unbit.it
Wii: 2999 4476 3509 0964
[-- Attachment #2: Questa è una parte del messaggio firmata digitalmente --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
prev parent reply other threads:[~2007-04-25 7:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-04-24 14:34 [ANNOUNCE] UidBind LSM 0.2 Roberto De Ioris
2007-04-24 20:13 ` Gerhard Mack
2007-04-24 20:40 ` Casey Schaufler
2007-04-24 22:11 ` Gerhard Mack
2007-04-25 7:28 ` Roberto De Ioris [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1177486102.25490.6.camel@hagrid \
--to=roberto@unbit.it \
--cc=gmack@innerfire.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox