On Tue, 2014-12-09 at 08:39 -0500, Daniel J Walsh wrote: > You can do this with SELinux and confined users somewhat. > > YOU basically could setup a user as xguest with no network access and > then write > policy to transition to certain domains that can use the internet. No > ability to prompt the user > though. > > This will get you most of the way you want to go, but somethings can be > tricky. > > Also lots of apps contact the network just by calling getpw* calls, if > you have certain settings in nsswitch. And by "certain settings" he means "default settings", because nsswitch.conf defaults to using the 'dns' library for host lookup, which means that any gethostby*() call will hit the network. As for users and groups, most modern systems don't hit the network directly anymore. The SSSD, Winbind and nss-pam-ldapd projects all provide a separate, privileged daemon to perform the actual network lookup, meaning that the application doesn't do it directly. Now, if the system is using the old nss_ldap instead of nss-pam-ldapd, that could be an issue, but I don't think we even ship that in Fedora anymore.
Attachment:
signature.asc
Description: This is a digitally signed message part
-- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
