Re: Sockets from kernel space?

[Arnaldo Carvalho de Melo <acme@conectiva.com.br>]

John Richard Moser wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Thanks.  I'll look at those.
> 
> I'm aiming at potentially writing an LSM that allows a process to attach
> to the kernel, which will then be sent messages through an AF_UNIX
> (these are the app<->app sockets right?) socket with the details of any
> listen(2) or connect(2) calls made.  I was going to do it in userspace,
> but realized it was easily avoidable that way.
> 
> If this works, I can pretty much securely create a host firewall that
> regulates based on network operations, user, and program.  This would
> allow the creation of discressionary firewalls, like Zone Alarm, Norton
> PF, McAffee PF, etc.  The daemon sits in userspace, the kernel asks it
> for policy decisions, it asks connected/authenticated clients about
> unknown policy, and makes them re-authenticate to get an answer.  The
> authentication is in userspace (PAM), hence the daemon.

Look at the iproute2 code to know how to use netlink 8)

- Arnaldo