Sockets from kernel space?
Subsystems (2)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Is it possible to create socket connections (AF_UNIX for example) from the kernel to local user processes that are listen()ing?
A good link to somewhere to help with this would be nice.
- --
All content of all messages exchanged herein are left in the Public Domain, unless otherwise explicitly stated.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFBwOcfhDd4aOud5P8RAkuYAJ0fvVUPHI5Wg3jn2ZNp0Y/2wSIRMgCfZDDb jJ+HOC9hbvTj8a/niubR2Dc=
=ONFE
-----END PGP SIGNATURE-----
Quoted 5 lines · John Richard Moser
-----BEGIN PGP SIGNED MESSAGE-----
Is it possible to create socket connections (AF_UNIXfor example) from the kernel to local user processes that are listen()ing?A good link to somewhere to help with this would be nice.
Please send networking development related messages to [email protected], there are several networking hackers that don't even subscribe lkml.
Having said that, look at the svc_makesock and svc_create_socket functions in net/sunrpc/svcsock.c as a starting point.
- Arnaldo
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Thanks. I'll look at those.
I'm aiming at potentially writing an LSM that allows a process to attach to the kernel, which will then be sent messages through an AF_UNIX (these are the app<->app sockets right?) socket with the details of any listen(2) or connect(2) calls made. I was going to do it in userspace, but realized it was easily avoidable that way.
If this works, I can pretty much securely create a host firewall that regulates based on network operations, user, and program. This would allow the creation of discressionary firewalls, like Zone Alarm, Norton PF, McAffee PF, etc. The daemon sits in userspace, the kernel asks it for policy decisions, it asks connected/authenticated clients about unknown policy, and makes them re-authenticate to get an answer. The authentication is in userspace (PAM), hence the daemon.
Arnaldo Carvalho de Melo wrote:
[...]
| | Please send networking development related messages to [email protected], | there are several networking hackers that don't even subscribe lkml. | | Having said that, look at the svc_makesock and svc_create_socket functions | in net/sunrpc/svcsock.c as a starting point. | | - Arnaldo
- --
All content of all messages exchanged herein are left in the Public Domain, unless otherwise explicitly stated.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFBwP26hDd4aOud5P8RAhSjAJ956RdBt9deoh3RgW7UKWdEgNeLMACeOR+b nVFR/uA/ZNXkv2b6HYcRczw=
=VUfC
-----END PGP SIGNATURE-----
Quoted 11 lines · John Richard Moser
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1Thanks. I'll look at those.
I'm aiming at potentially writing an LSM that allows a process to attach to the kernel, which will then be sent messages through an
AF_UNIX(these are the app<->app sockets right?) socket with the details of any listen(2) or connect(2) calls made. I was going to do it in userspace, but realized it was easily avoidable that way.
Quoted 7 lines
If this works, I can pretty much securely create a host firewall that regulates based on network operations, user, and program. This would allow the creation of discressionary firewalls, like Zone Alarm, Norton PF, McAffee PF, etc. The daemon sits in userspace, the kernel asks it for policy decisions, it asks connected/authenticated clients about unknown policy, and makes them re-authenticate to get an answer. The authentication is in userspace (PAM), hence the daemon.
Look at the iproute2 code to know how to use netlink 8)
- Arnaldo
hoi :)
Quoted 2 lines · John Richard Moser
Is it possible to create socket connections (
AF_UNIXfor example) from the kernel to local user processes that are listen()ing?
AF_NETLINK is made for exactly that purpose.
look at linux/netlink.h and net/ipv4/netfilter/ipt_ULOG.c for example code.
Signature · 1 line
Martin Waitz