From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: AUDIT_NETFILTER_PKT message format Date: Sat, 21 Jan 2017 12:37:50 -0500 Message-ID: References: <20170117052551.GQ3087@madcap2.tricolour.ca> <20170118151520.GY3087@madcap2.tricolour.ca> <21839828.eXAB1nqvpV@x2> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: Steve Grubb , Richard Guy Briggs , Paul Moore , Linux-Audit Mailing List , Netfilter Developer Mailing List , Thomas Graf To: Patrick PIGNOL Return-path: Received: from mail-ua0-f172.google.com ([209.85.217.172]:32967 "EHLO mail-ua0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750965AbdAURhv (ORCPT ); Sat, 21 Jan 2017 12:37:51 -0500 Received: by mail-ua0-f172.google.com with SMTP id i68so84285352uad.0 for ; Sat, 21 Jan 2017 09:37:51 -0800 (PST) In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Sat, Jan 21, 2017 at 6:27 AM, Patrick PIGNOL wrote: > Hi all, > > I disagree ! > > Many people in the world would like to allow an software A to go to internet > through OUTPUT TCP port 80 but disallow software B to go to the internet > through this same OUTPUT TCP port 80. Don't you know about viruses on linux > ? Viruses ALWAYS use HTTP/HTTPS ports to get payloads on internet and OUTPUT > TCP port 443 COULD NOT be CLOSED for ALL SOFTWARE if you want to access > internet services (via internet browsers for example). The Linux audit subsystem simply logs system events, it does not enforce security policy. I suggest you investigate the different Linux firewall tools and LSMs, e.g. SELinux, as they should help you accomplish what you describe. -- paul moore www.paul-moore.com