process, which can run in a different compartment. Access checks are performed on the compartment containing the endpoint when the endpoint was created, not the current compartment. Additionally, the endpoint passes its compartment configuration to accepting endpoints when it receives new connections.
INET domain endpoints are frequently used for interprocess communications. Be sure to configure your compartments accordingly.
The syntax for a network rule is as follows:
(grantdeny) (serverclientbidir) (tcpudpraw [<protonum>] ) [port <port_num>] [peer[port<port>]] <compartment_name>
For example:
/* allow all inbound TCP connections (any port) from interfaces labeled lancmpt1 */
grant server tcp lancmpt1
/* allow DNS client lookups (both TCP and UDP) through interface labeled lancmpt1 */
grant client tcp port 53 lancmpt1 grant bidir udp port 53 lancmpt1
/* allow only outbound telnet connections through interface labeled ifacelan0 */
grant client tcp peer port 23 ifacelan0
/* allow all TCP traffic except inbound telnet through interface labeled ifacelan0 */ /* the following two lines can be specified in either order */
grant bidir tcp ifacelan0
deny server tcp port 23 ifacelan0
/* allow inbound web server traffic through interface lan1cmpt */
grant server tcp port 80 lan1cmpt
Access | Grants or denies the compartment access to the network traffic in the | |
| specified compartment. The options are: | |
| • | grant |
| • | deny |
Direction | Specifies which direction the rule applies to. The options are: | |
• server: This rule applies to inbound requests only. For TCP, only incoming connections are controlled by this rule. For UDP and RAW, this rule applies to all inbound packets.
• client: This rule applies outbound requests only. For TCP, only connection initiations are controlled by this rule. For UDP and RAW, this rule applies to all outbound packets.
• bidir: This rule applies to both inbound and outbound requests. For TCP, connections initiated and received by the endpoint are controlled by this rule. For UDP and RAW, this rule applies to all packets passing through the endpoint.
66 Compartments
