Message-ID: <52D04C59.20406@quarksecurity.com>
Date: Fri, 10 Jan 2014 14:39:05 -0500
From: Joshua Brindle <brindle@quarksecurity.com>
User-Agent: Postbox 3.0.8 (Macintosh/20130427)
MIME-Version: 1.0
To: Victor Porton <porton@narod.ru>
CC: selinux@tycho.nsa.gov, linux-kernel@vger.kernel.org
Subject: Re: Create new NetFilter table
References: <1171389381947@web15m.yandex.ru>
In-Reply-To: <1171389381947@web15m.yandex.ru>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org

Victor Porton wrote:
> I propose to create a new NetFilter table dedicated to rules created programmatically (not by explicit admin's iptables command).
>
> Otherwise an admin could be tempted to say `iptables -F security` which would probably break rules created for example by sandboxing software (which may follow same-origin policy to restrict one particular program to certain domain and port only). Note that in this case `iptables -F security` is a security risk (sandbox breaking)?
>
> New table could be possibly be called:
>
> - temp
> - temporary
> - auto
> - automatic
> - volatile
> - daemon
> - system
> - sys
>
> In iptables docs it should be said that this table should not be manipulated manually.

Is it possible that the solution to your sandboxing problem is seccomp 
filter?

http://outflux.net/teach-seccomp/

You'd filter out any syscall that can make outbound connections and then 
only pass already opened sockets to the sandboxed threads?

seccomp filter was actually created for sandboxing, so that user 
applications could voluntarily shed the ability to call certain syscalls 
before handling untrusted data.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/