But yes, the above can be done with SELinux as well. Maybe that will
could actually provide a better user experience since you'd get error
messages when binding sockets instead of mostly silently dropped
packets.
Exactly my point. Rejecting the bind() call allows the app to present an understandable error, within the context of the application. With an interactive app it could provide a pretty GUI error dialog right then and there. The API we need is there already. We're just not using it.
-- fedora-devel-list mailing list fedora-devel-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-devel-list
