Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working on a setup for a Linux based system in which user applications are executed in Linux Containers to provide confinement and limited capabilities. Each application is launched under in a container with a specific user ID.

Now, given that some of these applications are going to have server roles, I would like to be able to control which ports a specific user can bind (both TCP and UDP). One solution is manually polling /proc/net/(tcp|udp)6? but this is very inefficient for obvious reasons. So, I was wondering if there is a better way to do this?

share|improve this question
    
By "Linux Containers" do you mean LXC? –  mgorven May 11 '12 at 2:48
    
Yep, but that is somewhat besides the point, as LXC simply relies on kernel modules. I'm investigating GRSecurity as a possiblity. –  Nick Bruun May 11 '12 at 12:33
add comment

2 Answers

up vote 0 down vote accepted

AppArmor and SELinux can be used to restrict network access by processes.

share|improve this answer
    
AppArmor turned out to be the good solution. Thanks ;) –  Nick Bruun May 16 '12 at 15:17
add comment

There is also iptables user match.

share|improve this answer
2  
an example would be nice :) –  Lucas Kauffman Jul 20 '12 at 18:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.