[ANNOUNCE] UidBind LSM 0.2

[Roberto De Ioris]

Hi all,

this is the second release for UidBind LSM:

http://projects.unbit.it/uidbind/

UidBind allows call to bind() function only to the uid defined in a
configfs tree.

It is now possible to specify different uid (for the same port) on
different ipv4 addresses:

mkdir uidbind/8081
mkdir uidbind/8081/192.168.1.17
mkdir uidbind/8081/192.168.1.26
echo 1017 > uidbind/8081/192.168.1.17/uid
echo 1026 > uidbind/8081/192.168.1.26/uid

This version even fix some leek in version 0.1

Patch attached is still for vanilla 2.6.20.7

--
Roberto De Ioris
http://unbit.it
JID: rob...@jabber.unbit.it
Wii: 2999 4476 3509 0964

[Gerhard Mack]

On Tue, 24 Apr 2007, Roberto De Ioris wrote:

> Hi all,
>
> this is the second release for UidBind LSM:
>
> http://projects.unbit.it/uidbind/
>
> UidBind allows call to bind() function only to the uid defined in a
> configfs tree.
>
> It is now possible to specify different uid (for the same port) on
> different ipv4 addresses:
>
> mkdir uidbind/8081
> mkdir uidbind/8081/192.168.1.17
> mkdir uidbind/8081/192.168.1.26
> echo 1017 > uidbind/8081/192.168.1.17/uid
> echo 1026 > uidbind/8081/192.168.1.26/uid
>
> This version even fix some leek in version 0.1
>
> Patch attached is still for vanilla 2.6.20.7

Is it possible to specify ranges as allowing everyone? Is it possible to
allow multiple users acess to the same port? Can ports be allowed by
group?

I really like the idea of this patch. It has the potential to solve a lot
of my current administrative headachs.

Gerhard

--
Gerhard Mack

gm...@innerfire.net

<>< As a computer I find your faith in technology amusing.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[Casey Schaufler]

--- Gerhard Mack <gm...@innerfire.net> wrote:

> On Tue, 24 Apr 2007, Roberto De Ioris wrote:
>
> > Hi all,
> >
> > this is the second release for UidBind LSM:
> >
> > http://projects.unbit.it/uidbind/
> >
> > UidBind allows call to bind() function only to the uid defined in a
> > configfs tree.
> >
> > It is now possible to specify different uid (for the same port) on
> > different ipv4 addresses:
> >
> > mkdir uidbind/8081
> > mkdir uidbind/8081/192.168.1.17
> > mkdir uidbind/8081/192.168.1.26
> > echo 1017 > uidbind/8081/192.168.1.17/uid
> > echo 1026 > uidbind/8081/192.168.1.26/uid
> >
> > This version even fix some leek in version 0.1
> >
> > Patch attached is still for vanilla 2.6.20.7
>
> Is it possible to specify ranges as allowing everyone? Is it possible to
> allow multiple users acess to the same port? Can ports be allowed by
> group?

If you're going to go beyond the simple owner access model it
probably makes sense to go all out, swipe the file system ACL
code and provide the whole nine yards of users, groups, and modes.
The only system that I know of that had socket ACLs was the 4.X
version of Trusted Irix, and socket ACLs were dropped in 5.0 because
they were unpopular.

If you're daring you could propose that low number ports be treated
the same way as other ports, with the default ownership being root and
the default ACL allowing only root.

> I really like the idea of this patch. It has the potential to solve a lot
> of my current administrative headachs.

Putting access control on ports rather than sockets is a novel
approach. It is a lot simpler underneath and more consistant with
the way other object name spaces are treated.

Casey Schaufler
ca...@schaufler-ca.com

[Gerhard Mack]

ACL may be more complicated than needed when a simple GID addition would
make this right about perfect.

> > I really like the idea of this patch. It has the potential to solve a lot
> > of my current administrative headachs.
>
> Putting access control on ports rather than sockets is a novel
> approach. It is a lot simpler underneath and more consistant with
> the way other object name spaces are treated.

Indeed I'm fond of it's rather simple and very scriptable interface.

Gerhard

--
Gerhard Mack

gm...@innerfire.net

<>< As a computer I find your faith in technology amusing.

[Roberto De Ioris]

Il giorno mar, 24/04/2007 alle 18.11 -0400, Gerhard Mack ha scritto:
> On Tue, 24 Apr 2007, Casey Schaufler wrote:
>
> > --- Gerhard Mack <gm...@innerfire.net> wrote:

> > If you're daring you could propose that low number ports be treated
> > the same way as other ports, with the default ownership being root and
> > the default ACL allowing only root.
>
> ACL may be more complicated than needed when a simple GID addition would
> make this right about perfect.

The unix way(TM) for specifying multiple uid is...ehm.. groups :)
I will add the gid,tcp_gid and udp_gid configfs attributes in the next
release.
The 'check order' will be:

uidbind/<port>/<ip>/<proto>_uid
uidbind/<port>/<ip>/uid
uidbind/<port>/<proto>_uid
uidbind/<port>/uid
uidbind/<port>/<ip>/<proto>_gid
uidbind/<port>/<ip>/gid
uidbind/<port>/<proto>_gid
uidbind/<port>/gid

I am investigating the possibility of port-range use, particularly the
overlap checks and performance problems.