Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
RE: selinux_socket_bind hook: msg#00255
|
Subject: |
RE: selinux_socket_bind hook |
Stephen Smalley wrote:
> On Thu, 2005-04-28 at 12:32 -0400, Steve Brueckner wrote:
>> In trying to segment networking into two domains I seem to have
>> overlooked that name_bind doesn't get enforced for ports within the
>> machine's local port range (i.e. ports assigned by the kernel). I
>> suppose I could try to hack the LSM selinux_socket_bind hook to
>> enforce name_bind for all ports; would that be possible? I'd rather
>> not, though, since I've never ventured deeper than SELinux policy,
>> and delving into the mechanism scares me. Is it possible to somehow
>> implement a boolean that would toggle whether name_bind was enforced
>> for all ports or just for ports outside the local port range?
>
> That hook is only applied for explicit bind(2) calls by applications.
> auto-binding of unbound sockets by the kernel (e.g. when sending on
> an unbound socket) will never hit that hook at all. You would need
> to modify udp_v4_get_port and tcp_v4_get_port to check permission and
> keep scanning for another available port until one is allowed. Not
> likely to make much headway upstream.
Darn. But thank you for the clarification.
- Steve Brueckner, ATC-NY
|
| |
