[Top] [All Lists]

Re: Sockets from kernel space?

To: John Richard Moser <nigelenki@xxxxxxxxxxx>
Subject: Re: Sockets from kernel space?
From: Arnaldo Carvalho de Melo <acme@xxxxxxxxxxxxxxxx>
Date: Thu, 16 Dec 2004 00:29:46 -0200
Cc: netdev@xxxxxxxxxxx
In-reply-to: <41C0FDBA.5060406@xxxxxxxxxxx>
Organization: Conectiva S.A.
References: <41C0E720.8050201@xxxxxxxxxxx> <41C0DF8B.2020007@xxxxxxxxxxxxxxxx> <41C0FDBA.5060406@xxxxxxxxxxx>
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mozilla Thunderbird 0.9 (X11/20041103)
John Richard Moser wrote:
Hash: SHA1

Thanks.  I'll look at those.

I'm aiming at potentially writing an LSM that allows a process to attach
to the kernel, which will then be sent messages through an AF_UNIX
(these are the app<->app sockets right?) socket with the details of any
listen(2) or connect(2) calls made.  I was going to do it in userspace,
but realized it was easily avoidable that way.

If this works, I can pretty much securely create a host firewall that
regulates based on network operations, user, and program.  This would
allow the creation of discressionary firewalls, like Zone Alarm, Norton
PF, McAffee PF, etc.  The daemon sits in userspace, the kernel asks it
for policy decisions, it asks connected/authenticated clients about
unknown policy, and makes them re-authenticate to get an answer.  The
authentication is in userspace (PAM), hence the daemon.

Look at the iproute2 code to know how to use netlink 8)

- Arnaldo

<Prev in Thread] Current Thread [Next in Thread>