Allow internet/network access based on binary -- ask user for permission if a binary wants to connect to the internet

[Bastien Nocera]

----- Original Message -----
> You can do this with SELinux and confined users somewhat.
> 
> YOU basically could setup a user as xguest with no network access and
> then write
> policy to transition to certain domains that can use the internet.  No
> ability to prompt the user
> though.
> 
> This will get you most of the way you want to go, but somethings can be
> tricky.

Yeah, one user per application is certainly not something we'd want to
implement ;)

> Also lots of apps contact the network just by calling getpw* calls, if
> you have certain settings in nsswitch.

SELinux is probably going to have a lot of use in identifying/vouching for
applications in the sandboxed world, but we're not there just yet.