Allowing connect to all except one IP?

[man4atl]

How do I ban a process to connect to a particular IP, that is, to allow it to connect to all IP excetp one. For example,
/usr/local/bin/RealPlayer
{
...
connect ! ads.real.com
connect ! update.real.com
}

Such syntax does not seem to work.

Thanks.

Sicerely,
Peter

[spender]

It's something I have planned to do after the grsecurity2 documentation is done.

-Brad

[man4atl]

Thanks. It would be very useful.
But more general, if ACLs can include iptables commands or something like that, to apply iptables rules on a process basis, it would be even more powerful.

Peter

[spender]

There is already an iptables module that can do that. It's called "owner". You can select it in the default kernel's configuration.

-Brad