Re: [ANNOUNCE] UidBind LSM 0.2

[Casey Schaufler <casey@schaufler-ca.com>]

--- Gerhard Mack <gmack@innerfire.net> wrote:

> On Tue, 24 Apr 2007, Roberto De Ioris wrote:
> 
> > Hi all,
> > 
> > this is the second release for UidBind LSM:
> > 
> > http://projects.unbit.it/uidbind/
> > 
> > UidBind allows call to bind() function only to the uid defined in a
> > configfs tree.
> > 
> > It is now possible to specify different uid (for the same port) on
> > different ipv4 addresses:
> > 
> > mkdir uidbind/8081
> > mkdir uidbind/8081/192.168.1.17
> > mkdir uidbind/8081/192.168.1.26
> > echo 1017 > uidbind/8081/192.168.1.17/uid
> > echo 1026 > uidbind/8081/192.168.1.26/uid
> > 
> > This version even fix some leek in version 0.1
> > 
> > Patch attached is still for vanilla 2.6.20.7
> 
> Is it possible to specify ranges as allowing everyone?  Is it possible to 
> allow multiple users acess to the same port?  Can ports be allowed by 
> group?

If you're going to go beyond the simple owner access model it
probably makes sense to go all out, swipe the file system ACL
code and provide the whole nine yards of users, groups, and modes.
The only system that I know of that had socket ACLs was the 4.X
version of Trusted Irix, and socket ACLs were dropped in 5.0 because
they were unpopular.

If you're daring you could propose that low number ports be treated
the same way as other ports, with the default ownership being root and
the default ACL allowing only root.

> I really like the idea of this patch.  It has the potential to solve a lot 
> of my current administrative headachs.

Putting access control on ports rather than sockets is a novel
approach. It is a lot simpler underneath and more consistant with
the way other object name spaces are treated.


Casey Schaufler
casey@schaufler-ca.com