grsecurity forums

How do I ban a process to connect to a particular IP, that is, to allow it to connect to all IP excetp one. For example,
/usr/local/bin/RealPlayer
{
...
connect ! ads.real.com
connect ! update.real.com
}

Such syntax does not seem to work.

Thanks.

Sicerely,
Peter

It's something I have planned to do after the grsecurity2 documentation is done.

-Brad

Thanks. It would be very useful.
But more general, if ACLs can include iptables commands or something like that, to apply iptables rules on a process basis, it would be even more powerful.

Peter

There is already an iptables module that can do that. It's called "owner". You can select it in the default kernel's configuration.

-Brad