Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a dedicated machine on RHEL (CentOS 6.3) that runs with multiple IP addresses. Multiple users also have access to the machine, on non-superuser accounts. I would like to prevent them from binding to certain addresses.

I do know that Linux can restrict ports for non-root users, as is currently done for ports less than or equal to 1024. If I wanted to prevent access to a specific IP address such as 0.0.0.0, or a range such as 127.0.0.0/8, would doing so be possible, and if so, how would it be done?

Or inversely, how would I deny all access to bind to any IP addresses, and grant access to individual addresses by user?

share|improve this question
    
SELinux would be an option –  fuero May 17 '13 at 5:16

1 Answer 1

I won't go into detail on how SELinux is set up or how one creates a SELinux policy. This might be a good starting point for getting familiar with SELinux.

To address your problem with SELinux, try this:

  • Assign a type to the network interface you like to restrict

    # Assign a type to the whole interface
    semanage interface -a -t foo_netif_t eth2
    
  • Assign labels to traffic passing through the interface

    netlabelctl unlbl add interface:eth2 address:0.0.0.0/0 label:system_u:object_r:foo_peer_t:s0
    netlabelctl unlbl add interface:eth2 address:::/0 label:system_u:object_r:foo_peer_t:s0
    

    This example assigns the type foo_peer_t to all IPv4 and IPv6 traffic.

  • Add rules to allow packet flow

    Traffic entering

    allow user_t foo_netif_t:netif ingress;
    allow user_t foo_peer_t:node recvfrom;
    

    Traffic leaving

    allow user_t foo_netif_t:netif egress;
    allow user_t foo_peer_t:node sendto;
    

    Replace user_t with type assigned to the user you wish to restrict.

References:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.