----- Original Message -----
> You can do this with SELinux and confined users somewhat.
> 
> YOU basically could setup a user as xguest with no network access and
> then write
> policy to transition to certain domains that can use the internet.  No
> ability to prompt the user
> though.
> 
> This will get you most of the way you want to go, but somethings can be
> tricky.

Yeah, one user per application is certainly not something we'd want to
implement ;)

> Also lots of apps contact the network just by calling getpw* calls, if
> you have certain settings in nsswitch.

SELinux is probably going to have a lot of use in identifying/vouching for
applications in the sandboxed world, but we're not there just yet.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Reply via email to