RE: Labeled networking packets

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

On Fri, 2006-09-22 at 16:57 -0400, Stephen Smalley wrote:
> On Fri, 2006-09-22 at 13:23 -0400, Venkat Yekkirala wrote:
> > OK, here's what we will do:
> > 
> > 1. We will have getpeercon() fail if there's no labeled-SA.
> > 
> > 2. We will do a getdatacon() or something similar to retrieve the
> >    secmark (as reconciled in the proposed reconciliation logic, of course).
> > 
> > Comments?
> 
> I think that just moves the problem.  The question is still whether we
> can have a coherent policy using that reconciliation logic for both
> users of secmark.

This is one of my primary concerns as we are one of the groups that will
attempt to package all of this up, present it to users in a coherent
way, and explain to customers why what they thought is happening is not
happening.

<snip>

>  So we now have multiple rules on packet class to
> achieve the same goal via different mechanisms, and getdatacon() can
> potentially return any of these types.
> 

Exactly. We need _one_ policy regardless of the labeling mechanism that
is used.

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.