Linux: Allow/restrict IP bind permissions by user

I won't go into detail on how SELinux is set up or how one creates a SELinux policy. This might be a good starting point for getting familiar with SELinux.

To address your problem with SELinux, try this:

• Assign a type to the network interface you like to restrict

  # Assign a type to the whole interface
  semanage interface -a -t foo_netif_t eth2
  

• Assign labels to traffic passing through the interface

  netlabelctl unlbl add interface:eth2 address:0.0.0.0/0 label:system_u:object_r:foo_peer_t:s0
  netlabelctl unlbl add interface:eth2 address:::/0 label:system_u:object_r:foo_peer_t:s0
  

  This example assigns the type foo_peer_t to all IPv4 and IPv6 traffic.

• Add rules to allow packet flow

  Traffic entering

  allow user_t foo_netif_t:netif ingress;
  allow user_t foo_peer_t:node recvfrom;
  

  Traffic leaving

  allow user_t foo_netif_t:netif egress;
  allow user_t foo_peer_t:node sendto;
  

  Replace user_t with type assigned to the user you wish to restrict.

References:

• Labeling interfaces
• Ingress/Egress controls