HP-UX 11i Security Containment Administrator's Guide for HP-UX 11i v2

process, which can run in a different compartment. Access checks are performed on the

compartment containing the endpoint when the endpoint was created, not the current

compartment. Additionally, the endpoint passes its compartment configuration to accepting

endpoints when it receives new connections.

INET domain endpoints are frequently used for interprocess communications. Be sure to configure

your compartments accordingly.

The syntax for a network rule is as follows:

[port <port_num>] [peer[port<port>]] <compartment_name>

For example:

/* allow all inbound TCP connections (any port) from interfaces labeled lancmpt1 */

grant server tcp lancmpt1

/* allow DNS client lookups (both TCP and UDP) through interface labeled lancmpt1 */

grant client tcp port 53 lancmpt1

grant bidir udp port 53 lancmpt1

/* allow only outbound telnet connections through interface labeled ifacelan0

grant client tcp peer port 23 ifacelan0

/* allow all TCP traffic except inbound telnet through interface labeled ifacelan0 */

/* the following two lines can be specified in either order */

grant bidir tcp ifacelan0

deny server tcp port 23 ifacelan0

/* allow inbound web server traffic through interface lan1cmpt */

grant server tcp port 80 lan1cmpt

Access Grants or denies the compartment access to the network traffic in the

specified compartment. The options are:

• grant

• deny

Direction Specifies which direction the rule applies to. The options are:

• server: This rule applies to inbound requests only. For TCP, only

incoming connections are controlled by this rule. For UDP and

RAW, this rule applies to all inbound packets.

• client: This rule applies outbound requests only. For TCP, only

connection initiations are controlled by this rule. For UDP and

RAW, this rule applies to all outbound packets.

• bidir: This rule applies to both inbound and outbound requests.

For TCP, connections initiated and received by the endpoint are

controlled by this rule. For UDP and RAW, this rule applies to all

packets passing through the endpoint.

66 Compartments