grsecurity forums

I was wondering if it's possible (and if so, how?) to make a ruleset in the policy that allows only people in a specified GID to bind to an interface. For instance, users in group "users" allowed access to 198.168.1.100 while being denied the ability to use 192.168.1.101 unless they're in a group a special group, in which case they have access to both IPs. Is this possible?

ralphy wrote:I was wondering if it's possible (and if so, how?) to make a ruleset in the policy that allows only people in a specified GID to bind to an interface. For instance, users in group "users" allowed access to 198.168.1.100 while being denied the ability to use 192.168.1.101 unless they're in a group a special group, in which case they have access to both IPs. Is this possible?

ralphy: you can do this through roles, your users would have to gradm to a special role where they will be allowed access. The notion of groups and users, I doubt you can do that.

Make a group role, and in each subject in that role, make sure that your bind rules only allow binding to the specific IP you mentioned. Remember that the RBAC system supports virtual interface support as well (as described in the sample policy)

-Brad