RE: Would the SELinux act as a TippingPoint IPS to block the nasty Trojan traffic?

["Venkat Yekkirala" <vyekkirala@TrustedCS.com>]

> > How does this work into the idea we had during the summit 
> about SELinux
> > having its own table? The table would presumably be a 
> mangle table for
> > labeling but could it also be a filter table? I'm not clear 
> on what is
> > possible in netfilter.
> 
> I'm not a netfilter expert myself, although I'm learning more 
> and more about 
> it each day.  I don't see how this couldn't fit into the proposed 
> LSM/SELinux/security table in fact I think I mentioned 
> something like this at 
> one point (although, maybe it was just to myself).

To share some preliminary thoughts on this, we might be able to have
the security table have 2 built-in chains, say, secmark and secfilter,
and have these chains traversed at the appropriate points as in the
following example for the INPUT case:

...
mangle PREROUTE
security SECMARK
filter INPUT
security SECFILTER
...

It's also conceivable that we might, in fact, have two tables (secmark
and secfilter), all things considered.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.