Hello.
Patrick McHardy wrote:
> Quoting Tetsuo:
> > > So, my approach is not using security context associated with a socket
> > > but security context associated with a process.
> Isn't the socket context derived from the process context?
Not so regarding my case.
static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
{
sk->sk_security = current->security;
return 0;
}
will not help what I want to do.
So, I'm not planning to use "sk->sk_security".
I'm planning to use "current->security" at accept()/recvmsg() time.
What I want to do is to enforce subset of TCP Wrapper inside the kernel space
so that "IP/port based filtering for TCP and UDP is applied to ALL processes"
and "IP/port based filtering for TCP and UDP is not bypassed by processes that
are
linked with TCP Wrapper library (even if accept()/recvmsg() syscalls are
directly called)".
To receive source IP/port of a incoming packet, non-NULL msg->msg_name is
needed for receiving them,
and I'm proposing modifications in net/socket.c .
Regards.
-
To unsubscribe from this list: send the line "unsubscribe
linux-security-module" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
