Re: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4)

From: Serge E. Hallyn
Date: Thu Jan 14 2010 - 12:37:20 EST

Quoting Michael Stone (michael@xxxxxxxxxx):
> Quoting Michael Stone (michael@xxxxxxxxxx):
> >Ah - but I worry that if you do that Alan or others will object. Where do
> >you plan to store the disablenet_allowed bit?
> If using prctl directly, I would store the bit in the task->network bitfield
> introduced by the earlier patches.
> >You can use security_prctl() to keep the code out of sys_prctl().
> I don't understand this suggestion; can you clarify? (Also, for what it's
> worth: I intended to put the check for CAP_SETPCAP in prctl_set_network().)
> >but you still have the question of whether you add a bit to the task struct,
> >use task->security and not stack with selinux, use a thread flag, or try to
> >enable stacking of task->security.
> For this revision of the patch, I will use the same approach as the previous
> patches (conditionally compiled task->network).
> Michael
> P.S. - Patches to follow tonight or tomorrow.

Cool I'll just wait for the patches :)

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at