Re: RFC: Network privilege separation.

Andi Kleen
2009-01-12T19:29:24Z

> Yes, the network access part *is* something that should be part of a more
> general interface. Having said that, we currently are lacking a way for a
> *general user* program to say "I'm all set up, and would like to disavow any
> other further resource access (except maybe r/o access as "other" to file
> systems)".

seccomp does exactly that. It's quite obscure, but available in most
linux kernels. Basically it blocks everything except
read/write on already open file descriptors.

I always thought it would be nice if codecs (which tend
to be full of security holes) ran in such jails by default

-Andi

--
ak@linux.intel.com -- Speaking for myself only.