Re: A few thoughts..

From: Joerg Sonnenberger (joerg_at_britannica.bec.de)
Date: 03/29/05

  • Next message: Joerg Sonnenberger: "Re: organization" 
    Date: Tue, 29 Mar 2005 23:28:10 +0200
To: freebsd-hackers@freebsd.org

    On Tue, Mar 29, 2005 at 03:12:25PM -0600, H. S. wrote:
    > This could be compared to what was done in FreeBSD lately, I remember in
    > 4.7 (and probably later, up to 4.10 I think) a user could see the full
    > connection lists (even connections from other users), only later the
    > kern.ps_showallprocs/security.bsd.see_other_uids took effect for these
    > matters too.

    It needs time to implement and actually process such checks.

    > > Have a look at mac(3), mac(4) and mac.conf(5), it's not systrace but you
    > > can achieve
    > > similar results.
    >
    > Systrace is much more complex than mac.

    That's a good one! It's actually quite the reverse, MAC is much more
    powerful than systrace, simply because it operates on a different
    level. You can do all this kind of checks with a MAC policy, if
    something does not have the necessary hooks, complain to Robert Watson :)

    Joerg
    _______________________________________________
    freebsd-hackers@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
    To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"

  • Next message: Joerg Sonnenberger: "Re: organization"