From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1K97b2-0006Fu-In for qemu-devel@nongnu.org; Wed, 18 Jun 2008 20:01:48 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1K97b0-0006EH-Q9 for qemu-devel@nongnu.org; Wed, 18 Jun 2008 20:01:48 -0400 Received: from [199.232.76.173] (port=50785 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1K97b0-0006EA-IG for qemu-devel@nongnu.org; Wed, 18 Jun 2008 20:01:46 -0400 Received: from mail.codesourcery.com ([65.74.133.4]:55730) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1K97az-0007cr-RH for qemu-devel@nongnu.org; Wed, 18 Jun 2008 20:01:46 -0400 From: Paul Brook Subject: Re: [Qemu-devel] Disabling outgoing connectiong from within guest Date: Thu, 19 Jun 2008 01:01:42 +0100 References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Message-Id: <200806190101.42916.paul@codesourcery.com> Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: =?utf-8?q?=C5=81ukasz?= Taczuk On Wednesday 18 June 2008, =C5=81ukasz Taczuk wrote: > Hi! > > I would like to create a sandboxed environment in which random users > would be able to roam freely using ssh. > However, I don't want to allow them to open outgoing connections just > as if the box was offline (even if the guest is compromised). > Basically I would like to have something like reversed user mode > network stack: you can log in to the guest, but once you're in, you > cannot connect to the host nor any other machine. Your host OS firewall/packet filter should already be able to do this. IMHO there's little or no point reimplementing this functionality in qemu. Paul