On Oct 24 2007 13:18, Crispin Cowan wrote: >Jan Engelhardt wrote: >> On Oct 24 2007 19:11, Simon Arlott wrote: >> >>> * (I've got a list of access rules which are scanned in order until one of >>> them matches, and an array of one bit for every port for per-port default >>> allow/deny - although the latter could be removed. >>> http://svn.lp0.eu/simon/portac/trunk/) >>> >> Besides the 'feature' of inhibiting port binding, >> is not this task of blocking connections something for a firewall? >> >So now you are criticizing his module. Arguing about the merits of >security semantics. This is exactly why Linus wanted LSM, so we don't >have to have these kinds of discussions, at least not on LKML :)
This was a question. I was perfectly aware that iptables alone does not prohibit binding, and there are reasons to inhibit binding. But sometimes, a coder does not know where to start - chances are, that someone else wanting to do bind(2) inhibiting is doing it with a syscall table change. Or coder did not notice that a firewall is sufficient for the task to be achieved (which is not always the case - hence the question). - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
