mirror of
git://git.code.sf.net/p/xtables-addons/xtables-addons
synced 2025-09-06 20:55:13 +02:00
9c4c76f9e2
This patch adds a module which is useful to users of grsecurity's RBAC system. It matches packets based on whether RBAC is enabled or disabled. See: http://grsecurity.net/ Signed-off-by: Anthony G. Basile <basile@opensource.dyc.edu> Jan Engelhardt> Also, I do not see a xt_gradm.c in this patch. This [xt_gradm.c] is part of the grsecurity patch which not only adds the Xtables code, but also the RBAC code. Without the entire RBAC stuff, xt_gradm does not make sense and so it is included with the grsecurity patch to the kernel, and not this patch to Xtables-addons. >Can you elaborate a bit on how this is useful in conjunction with >rulesets? I could imagine it be used with LSM selctx'es for example, >or another extension that tests for other RBAC attributes. The idea here is that when the RBAC rulesets are not being enforced, the system is more vulnerable and the user wants stricter firewall rules. When RBAC is being enforced, one can relax the firewall and access to services which are now better protected. In practice this usually means allowing only access to some trusted IP(s) on boot before RBAC is turned on.
29 lines
1.1 KiB
Makefile
29 lines
1.1 KiB
Makefile
# -*- Makefile -*-
|
|
|
|
obj-${build_ACCOUNT} += ACCOUNT/
|
|
obj-${build_CHAOS} += libxt_CHAOS.so
|
|
obj-${build_CHECKSUM} += libxt_CHECKSUM.so
|
|
obj-${build_DELUDE} += libxt_DELUDE.so
|
|
obj-${build_DHCPMAC} += libxt_DHCPMAC.so libxt_dhcpmac.so
|
|
obj-${build_ECHO} += libxt_ECHO.so
|
|
obj-${build_IPMARK} += libxt_IPMARK.so
|
|
obj-${build_LOGMARK} += libxt_LOGMARK.so
|
|
obj-${build_RAWNAT} += libxt_RAWDNAT.so libxt_RAWSNAT.so
|
|
obj-${build_STEAL} += libxt_STEAL.so
|
|
obj-${build_SYSRQ} += libxt_SYSRQ.so
|
|
obj-${build_TARPIT} += libxt_TARPIT.so
|
|
obj-${build_TEE} += libxt_TEE.so
|
|
obj-${build_condition} += libxt_condition.so
|
|
obj-${build_fuzzy} += libxt_fuzzy.so
|
|
obj-${build_geoip} += libxt_geoip.so
|
|
obj-${build_iface} += libxt_iface.so
|
|
obj-${build_ipp2p} += libxt_ipp2p.so
|
|
obj-${build_ipset} += ipset/
|
|
obj-${build_ipv4options} += libxt_ipv4options.so
|
|
obj-${build_length2} += libxt_length2.so
|
|
obj-${build_lscan} += libxt_lscan.so
|
|
obj-${build_pknock} += pknock/
|
|
obj-${build_psd} += libxt_psd.so
|
|
obj-${build_quota2} += libxt_quota2.so
|
|
obj-${build_gradm} += libxt_gradm.so
|