Isolation LSM: Difference between revisions
Jump to navigation
Jump to search
m (New page: [http://cr.yp.to/djb.html Daniel Bernstein] has observed that security-conscious unprivileged userland processes may benefit from the ability to irrevocably remove their ability to create,...) |
mNo edit summary |
||
| Line 2: | Line 2: | ||
[http://dev.laptop.org/git?p=users/mstone/olpc-2.6;a=commit;h=c05cc7eadcee3d9450c1eb6a41ef9c932f9aad53 This patch] defines a 'long sys_disablenetwork(void)' syscall and implements it in an LSM in order to avoid modifying the definition of 'struct task_struct'. |
[http://dev.laptop.org/git?p=users/mstone/olpc-2.6;a=commit;h=c05cc7eadcee3d9450c1eb6a41ef9c932f9aad53 This patch] defines a 'long sys_disablenetwork(void)' syscall and implements it in an LSM in order to avoid modifying the definition of 'struct task_struct'. |
||
[[Category:Security]] |
|||
Revision as of 15:58, 21 August 2008
Daniel Bernstein has observed that security-conscious unprivileged userland processes may benefit from the ability to irrevocably remove their ability to create, bind, connect to, or send messages to non-AF_UNIX sockets.
This patch defines a 'long sys_disablenetwork(void)' syscall and implements it in an LSM in order to avoid modifying the definition of 'struct task_struct'.