Subject: Re: [PATCH] Security: Add prctl(PR_{GET,SET}_NETWORK) interface.

From: Stephen Hemminger <[email-masked]>
Date: Fri, 18 Dec 2009 09:49:55 -0800

On Thu, 17 Dec 2009 22:00:57 -0500
Michael Stone <[email-masked]> wrote:

>    5. Linux today has pretty good support for controlling the creation of
>       channels involving the filesystem and involving shared daemons. It has
>       mediocre support for access control involving sysv-ipc mechanisms. It has
>       terrible support for access control involving non-local principals like
>       "the collection of people and programs receiving packets sent to
>       destination 18.0.0.1:80 from source 192.168.0.3:34661".

The policy control for this is done today on linux via the firewalling infrastructure.
It is not clear to me that moving over to the security infrastructure is an overall
gain from the security or user interface perspective.