3

I'm working on a setup for a Linux based system in which user applications are executed in Linux Containers to provide confinement and limited capabilities. Each application is launched under in a container with a specific user ID.

Now, given that some of these applications are going to have server roles, I would like to be able to control which ports a specific user can bind (both TCP and UDP). One solution is manually polling /proc/net/(tcp|udp)6? but this is very inefficient for obvious reasons. So, I was wondering if there is a better way to do this?

2
  • By "Linux Containers" do you mean LXC?
    – mgorven
    May 11, 2012 at 2:48
  • Yep, but that is somewhat besides the point, as LXC simply relies on kernel modules. I'm investigating GRSecurity as a possiblity.
    – Nick Bruun
    May 11, 2012 at 12:33

2 Answers 2

1

AppArmor and SELinux can be used to restrict network access by processes.

1
  • AppArmor turned out to be the good solution. Thanks ;)
    – Nick Bruun
    May 16, 2012 at 15:17
1

There is also iptables user match.

2
  • 2
    an example would be nice :) Jul 20, 2012 at 18:44
  • The iptables user match only works for OUTPUT chain so I don't think it's a good solution. Your app will be able to open the port and receive data but NOT sending. It really depends on the protocol you use through this port (http, ...). If the protocol you use needs negociation/exchange before being able to be used, you can use this... Feb 28, 2022 at 5:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .