Re: [ANNOUNCE] UidBind LSM 0.2

[Roberto De Ioris]

Il giorno mar, 24/04/2007 alle 18.11 -0400, Gerhard Mack ha scritto:
> On Tue, 24 Apr 2007, Casey Schaufler wrote:
> 
> > --- Gerhard Mack <gmack@xxxxxxxxxxxxx> wrote:

> > If you're daring you could propose that low number ports be treated
> > the same way as other ports, with the default ownership being root and
> > the default ACL allowing only root.
> 
> ACL may be more complicated than needed when a simple GID addition would 
> make this right about perfect.


The unix way(TM) for specifying multiple uid is...ehm.. groups :)
I will add the gid,tcp_gid and udp_gid configfs attributes in the next
release.
The 'check order' will be:

uidbind/<port>/<ip>/<proto>_uid  
uidbind/<port>/<ip>/uid
uidbind/<port>/<proto>_uid
uidbind/<port>/uid
uidbind/<port>/<ip>/<proto>_gid  
uidbind/<port>/<ip>/gid
uidbind/<port>/<proto>_gid
uidbind/<port>/gid

I am investigating the possibility of port-range use, particularly the
overlap checks and performance problems.

-- 
Roberto De Ioris
http://unbit.it
JID: roberto@xxxxxxxxxxxxxxx
Wii: 2999 4476 3509 0964

Attachment: signature.asc
Description: Questa =?ISO-8859-1?Q?=E8?= una parte del messaggiofirmata digitalmente