On Tue, 2009-04-07 at 16:39 +0200, Sebastian Pfaff wrote: > hello stephen, > > tnx for your answer. it helped me a lot. i already did a "quick" > check of hooks.c before but i was not sure about it. for me there are > some other unknowns. i only saw, that selinux does make some > differences between various port "types/classes". > > is it possible to control that process cannot bind to a port which is > in local port area (~32000-61000)? > > so far i think it isn't possible. Not without further kernel changes. You can however prevent it from creating or binding sockets in the first place, or you can use e.g. secmark to label all packets destined to a given port as having a given type and then have policy control what sockets can receive such packets. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
