--- Gerhard Mack <[EMAIL PROTECTED]> wrote: > On Tue, 24 Apr 2007, Roberto De Ioris wrote: > > > Hi all, > > > > this is the second release for UidBind LSM: > > > > http://projects.unbit.it/uidbind/ > > > > UidBind allows call to bind() function only to the uid defined in a > > configfs tree. > > > > It is now possible to specify different uid (for the same port) on > > different ipv4 addresses: > > > > mkdir uidbind/8081 > > mkdir uidbind/8081/192.168.1.17 > > mkdir uidbind/8081/192.168.1.26 > > echo 1017 > uidbind/8081/192.168.1.17/uid > > echo 1026 > uidbind/8081/192.168.1.26/uid > > > > This version even fix some leek in version 0.1 > > > > Patch attached is still for vanilla 2.6.20.7 > > Is it possible to specify ranges as allowing everyone? Is it possible to > allow multiple users acess to the same port? Can ports be allowed by > group?
If you're going to go beyond the simple owner access model it probably makes sense to go all out, swipe the file system ACL code and provide the whole nine yards of users, groups, and modes. The only system that I know of that had socket ACLs was the 4.X version of Trusted Irix, and socket ACLs were dropped in 5.0 because they were unpopular. If you're daring you could propose that low number ports be treated the same way as other ports, with the default ownership being root and the default ACL allowing only root. > I really like the idea of this patch. It has the potential to solve a lot > of my current administrative headachs. Putting access control on ports rather than sockets is a novel approach. It is a lot simpler underneath and more consistant with the way other object name spaces are treated. Casey Schaufler [EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/