RE: [PATCH 0/7] labeled ipsec policy changes

["Venkat Yekkirala" <vyekkirala@TrustedCS.com>]

Perhaps this can be simplified into the following (aside
from policy for setkey, racoon and association.setcontext):

1. Ability for a site to determine what domains can engage
   in UNLABELED IPSec communication. This can be ALL domains
   based on a boolean setting?

	allow domain unlabeled_t:association { sendto recvfrom };

2. Perhaps we can have ALL domains that can talk to the network
   be able to use labeled-ipsec communication by default?

	allow dom_with_net_access labeled_ipsec_t:association { polmatch };
	allow dom_with_net_access self:association { sendto };

3. The only remaining issue would then be deciding what domains
   can recv from what. This can perhaps be wrapped in an interface?

	allow local_dom1 peer_dom1:association { recvfrom }; 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.