Most access controls are for controlling input bound access, such as access to a service, or when you can login, or who can use samba or ssh.
There is an iptables module that can match the owner of a process. This would allow you to block off ports or an interface in the OUTPUT chain for a particular user.
You may also be able to add a policykit rule that matches a particular user. However, I don't know what action would match. ( Note to self: Find a good book on policy kit ).
Take a peek at the iptables info file:
Code:
owner
This module attempts to match various characteristics of the packet
creator, for locally-generated packets. It is only valid in the OUTPUT
chain, and even this some packets (such as ICMP ping responses) may
have no owner, and hence never match.
--uid-owner userid
Matches if the packet was created by a process with the given
effective user id.
--gid-owner groupid
Matches if the packet was created by a process with the given
effective group id.
--pid-owner processid
Matches if the packet was created by a process with the given
process id.
--sid-owner sessionid
Matches if the packet was created by a process in the given ses-
sion group.
--cmd-owner name
Matches if the packet was created by a process with the given
command name. (this option is present only if iptables was com-
I believe that a previous post on this site had an example where if a certain user makes a dns query, the destination address would be changed to an opendns server. This would allow enforcing family controls, for example.
---
I think that the http owner & group is a system owner/group that the apache web server uses instead of running as root. I don't think you want to add real users to the http group.
