4 messages, 4 authors, 2004-09-13 · open the first message on its own page
From: Alan Cox <hidden>
Date: 2004-09-13 12:00:33
On Llu, 2004-09-13 at 00:33, Serge E. Hallyn wrote:
Right now one must choose between either an ipv4 or ipv6 interface. Is typical ipv6 usage such that it would be preferable to be able to specify one of each?
Its normal to have both yes. A more interesting question is whether all of the "which socket for which use" stuff could be addressed by netfilter chains run at bind/connect time ?
From: Serge E. Hallyn <hidden>
Date: 2004-09-13 15:17:07
Quoting Alan Cox (alan@lxorguk.ukuu.org.uk):
On Llu, 2004-09-13 at 00:33, Serge E. Hallyn wrote:quoted
Right now one must choose between either an ipv4 or ipv6 interface. Is typical ipv6 usage such that it would be preferable to be able to specify one of each?Its normal to have both yes. A more interesting question is whether all of the "which socket for which use" stuff could be addressed by netfilter chains run at bind/connect time ?
You mean to add two new netfilter hooks? Would these then replace the LSM hooks? -serge
From: Serge Hallyn <hidden>
Date: 2004-09-13 22:14:50
On Mon, 2004-09-13 at 05:56, Alan Cox wrote:
On Llu, 2004-09-13 at 00:33, Serge E. Hallyn wrote:quoted
Right now one must choose between either an ipv4 or ipv6 interface. Is typical ipv6 usage such that it would be preferable to be able to specify one of each?Its normal to have both yes.
The attached version supports simultaneous ipv4 and ipv6 addresses. (Though only one of each) Signed-off-by: Serge Hallyn <redacted>
From: Vincent Hanquez <hidden>
Date: 2004-09-13 23:59:21
On Mon, Sep 13, 2004 at 06:20:05PM -0500, Serge Hallyn wrote:
+#define in_use(x) (x->jail_flags & IN_USE) +#define set_in_use(x) (x->jail_flags |= IN_USE) + +#define got_network(x) (x->jail_flags & (GOT_IPV4 | GOT_IPV6)) +#define got_ipv4(x) (x->jail_flags & (GOT_IPV4)) +#define got_ipv6(x) (x->jail_flags & (GOT_IPV6)) +#define set_ipv4(x) (x->jail_flags |= GOT_IPV4) +#define set_ipv6(x) (x->jail_flags |= GOT_IPV6) +#define unset_got_ipv4(x) (x->jail_flags &= ~GOT_IPV4) +#define unset_got_ipv6(x) (x->jail_flags &= ~GOT_IPV6) + +#define get_task_security(task) (task->security) +#define get_inode_security(inode) (inode->i_security) +#define get_sock_security(sock) (sock->sk_security) +#define get_file_security(file) (file->f_security) +#define get_ipc_security(ipc) (ipc->security) + +#define jail_of(proc) (get_task_security(proc)) + +#define set_task_security(task,data) task->security = data +#define set_inode_security(inode,data) inode->i_security = data +#define set_sock_security(sock,data) sock->sk_security = data +#define set_file_security(file,data) file->f_security = data +#define set_ipc_security(ipc,data) ipc.security = data
Hi Serge, Do you really need all thoses macros ? It seems to me that's too much macros for stuff which are easy to write and to understand. Just my 2cents, -- Tab