Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a setup for a Linux based system in which user applications are executed in Linux Containers to provide confinement and limited capabilities. Each application is launched under in a container with a specific user ID.

Now, given that some of these applications are going to have server roles, I would like to be able to control which ports a specific user can bind (both TCP and UDP). One solution is manually polling /proc/net/(tcp|udp)6? but this is very inefficient for obvious reasons. So, I was wondering if there is a better way to do this?

share|improve this question
By "Linux Containers" do you mean LXC? – mgorven May 11 '12 at 2:48
Yep, but that is somewhat besides the point, as LXC simply relies on kernel modules. I'm investigating GRSecurity as a possiblity. – Nick Bruun May 11 '12 at 12:33
up vote 1 down vote accepted

AppArmor and SELinux can be used to restrict network access by processes.

share|improve this answer
AppArmor turned out to be the good solution. Thanks ;) – Nick Bruun May 16 '12 at 15:17

There is also iptables user match.

share|improve this answer
an example would be nice :) – Lucas Kauffman Jul 20 '12 at 18:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.