Re: forbid internet access to an application?

That would of course be entirely trivial to evade. Just make a hard link
to
the program with a different name.

It is like denying access to a building to anyone who says their name is
John.
How long would that be effective?

I understand, but that would be the behaviour of a malign code. I'm not
talking of that, but only of preventing some normal application to access
the network. Since I use gentoo with kernel 2.6.20 SMP, from your answers I
have a confirmation that there's no way to do that with netfilter...
As for now, the only idea I have is if it is possible to define a selinux
policy with no access to the network, and then apply it to the applicatoin's
files. But it's only a supposition, since I actually haven't good knowledge
of selinux, and I guess it's not really easy to set it up with gentoo.

If you told us which program you wanted to restrict, then we could perhaps
give better advice.

Ok, so let's for instance consider ping.

Luca


.

Relevant Pages

  • Re: Ethernet controller fails to activate
    ... This is about Fedora 9 but first a little background. ... drivers for the on-board ethernet controller were missing in XP, ... I get a red X indicating problem with the network. ... /etc/init.d network restart I get the following error in SELinux ...
    (alt.os.linux)
  • Fedora issues (network)
    ... Not all of my problems are rooted in it but keep in mind that if everything seems ok then SElinux might be problematic. ... When SElinux on the server is off they work. ... Currently when I boot my computer without a network connection I need to run a script first ... sudo /sbin/ifconfig wlan0 up ...
    (Fedora)
  • SELinux / bind conflict
    ... I'm having a bit of difficulty setting up bind on FC11 which I'm ... using in a standalone network environment (i.e. no external network ... flag in SELinux, any actions related to starting or stopping the named ... Message log entry: ...
    (comp.protocols.dns.bind)
  • Re: Monitoring file integrity with FC4 - Tripwire??
    ... looks like I'm going to have to study the selinux ... This acts as a second firewall layer. ... >If you want to get really paranoid you can setup snort. ... >odd things on your network. ...
    (Fedora)
  • Re: [PATCH] Smack: Simplified Mandatory Access Control Kernel
    ... For that kind of protection profile, there is presently no substitute for SELinux with some X11 patches. ... AppArmor certainly doesn't meet the confidentiality requirements, and SMACK has no way of doing the very tight per-syscall security requirements we have to meet. ... Seriously, I've done Common Criteria and TCSEC evaluations on systems with less flexibility and granularity than Smack that included X, NFSv3, NIS, clusters, and all sorts of spiffy stuff. ... On the other hand, when designing a box that could theoretically be run on a semi-public unclassified network and yet still be safe enough to run classified data over IPsec links, you want to give the client all the warm fuzzies they ask for and more. ...
    (Linux-Kernel)