----- Original Message ----- > You can do this with SELinux and confined users somewhat. > > YOU basically could setup a user as xguest with no network access and > then write > policy to transition to certain domains that can use the internet. No > ability to prompt the user > though. > > This will get you most of the way you want to go, but somethings can be > tricky. Yeah, one user per application is certainly not something we'd want to implement ;) > Also lots of apps contact the network just by calling getpw* calls, if > you have certain settings in nsswitch. SELinux is probably going to have a lot of use in identifying/vouching for applications in the sandboxed world, but we're not there just yet. -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
