I'm running a dedicated machine on RHEL (CentOS 6.3) that runs with multiple IP addresses. Multiple users also have access to the machine, on non-superuser accounts. I would like to prevent them from binding to certain addresses.

I do know that Linux can restrict ports for non-root users, as is currently done for ports smaller than or equal to 1024. If I wanted to prevent access to a specific IP address such as, or a range such as, would doing so be possible, and if so, how would it be done?

Or inversely, how would I deny all access to bind to any IP addresses, and grant access to individual addresses by user?

  • SELinux would be an option – fuero May 17 '13 at 5:16
  • But sadly, SELinux sucks. Network namespaces provide a mechanism for seperatining access to specific interfaces and with with iptables, routing, bridging and dummy interface, you have a set of primitives from which it is possible to implement complex security policies - unix.stackexchange.com/questions/210982/… – symcbean Nov 3 '16 at 23:10

I won't go into detail on how SELinux is set up or how one creates a SELinux policy. This might be a good starting point for getting familiar with SELinux.

To address your problem with SELinux, try this:

  • Assign a type to the network interface you like to restrict

    # Assign a type to the whole interface
    semanage interface -a -t foo_netif_t eth2
  • Assign labels to traffic passing through the interface

    netlabelctl unlbl add interface:eth2 address: label:system_u:object_r:foo_peer_t:s0
    netlabelctl unlbl add interface:eth2 address:::/0 label:system_u:object_r:foo_peer_t:s0

    This example assigns the type foo_peer_t to all IPv4 and IPv6 traffic.

  • Add rules to allow packet flow

    Traffic entering

    allow user_t foo_netif_t:netif ingress;
    allow user_t foo_peer_t:node recvfrom;

    Traffic leaving

    allow user_t foo_netif_t:netif egress;
    allow user_t foo_peer_t:node sendto;

    Replace user_t with type assigned to the user you wish to restrict.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.