lkml.org 
[lkml]   [2008]   [Sep]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: SMACK netfilter smacklabel socket match
Tilman Baumann wrote:
> Am 26.09.2008 um 05:43 schrieb Casey Schaufler:
>
>> Tilman Baumann wrote:
>>> Hi all,
>>>
>>> i made some SMACK related patches. I hope this list is the right
>>> place to post them.
>>
>> Here and, probably more importantly
>> linux-security-module@vger.kernel.org as that's
>> my primary hang out.
>>
>>> The intention behind this patch is that i needed a way to (firewall)
>>> match for packets originating from specific processes.
>>> The existing owner match did not work well enough, especially since
>>> the cmd-owner part is removed.
>>> Then i thought about a way to tag processes and somehow match this
>>> tag in the firewall.
>>> I recalled that SELinux can do this (SECMARK) but SELinux would have
>>> been way to complex for what i want. But the idea was born, i just
>>> needed something more simple.
>>>
>>> SMACK seemed to be the right way. So i made a little primitive
>>> netfilter match to match against the security context of sockets.
>>> SMACK does CIPSO labels, but this was not what i wanted, i wanted to
>>> label the socket not the packet (on the wire).
>>> This of course only works for packets with a local socket, but this
>>> was my intention anyway.
>>>
>>> This way i can label a process and all it's sockets carry the same
>>> label which i then can use to match against in the firewall.
>>>
>>
>> Hmm. It looks as if your code will do what you're asking it to do.
>> Are you going to be happy with the access restrictions that will be
>> imposed by Smack?
>
> I helped myself with rules like this.
> _ foo rwx
> But i wanted to add some security stuff like selinux for years,
> and SMACK seems to be just great.
> So i will spend some time making security rules after i got this routing
> stuff to work. :)
>
I confess that I'm still not completely sure what you're up too,
but you might want to look at smackpolyport (it's in the smack-util
tarball) and might make your life easier if you want to have a
single server (running at foo) that deals with connections from
processes with multiple labels.




\
 
 \ /
  Last update: 2008-09-27 07:05    [W:0.092 / U:1.268 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site