RE: SELinux Networking Enhancements

["Venkat Yekkirala" <vyekkirala@TrustedCS.com>]

> > While you still disagree, I think most of us believe that secmarks
> 
> Only there are no secmarks in the new design to begin with. The word
> is a holdover from the current secmark design.
> 
> > should be _local only_ enforcement, not peer labeling, an 
> > ipsec rule is
> > in no way a "peer",
> 
> Agreed. But I fail to see where having a "default" peer on a 
> netfilter rule/secpoint
> would hurt. FYI- this is how MLS implementations work. You 
> have an interface
> that you would label everything coming thru by default with "Secret".
> 
> Also, don't we deem all data on a filesystem that doesn't 
> support individual
> file labeling to be at the label it's mounted at?
> 
> > a remote socket is a peer and a peer should
> > represent that.
> 
> Sure. That's also allowed in secpoint.

If it would serve your needs any better, we can have getpeercon return only
a "true" (meaning external) peer like you like to call it. We can find
someother way to retrieve the default as well (for MLS). Is that better?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.