netdev - Real networking namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091009083807.16e55b08@nehalam>
Date:	Fri, 9 Oct 2009 08:38:07 -0700
From:	Stephen Hemminger <shemminger@...ux-foundation.org>
To:	linux-security-module@...r.kernel.org
Cc:	Al Viro <viro@...IV.linux.org.uk>, netdev@...r.kernel.org
Subject: Real networking namespace

The existing networking namespace model is unattractive for what I want,
has anyone investigated better alternatives?

I would like to be able to allow access to a network interface and associated objects
(routing tables etc), to be controlled by Mandatory Access Control API's.
I.e grant access to eth0 and to only certain processes.  Some the issues
with the existing models are:
  * eth0 and associated objects don't really exist in filesystem so
    not subject to LSM style control (SeLinux/SMACK/TOMOYO)
  * network namespaces do not allow object to exist in multiple namespaces.
    The current model is more restrictive than chroot jails. At least with
    chroot, put filesystem objects in multiple jails.

Since one of the first rules of security is "don't reinvent", surely
others have dealt with this issue. Any good ideas?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html