Re: secmark integration

[Eric Paris <eparis@parisplace.org>]

On Fri, 2007-03-30 at 15:47 -0400, Karl MacMillan wrote:
> On Mon, 2007-03-19 at 10:57 -0400, James Morris wrote:
> > Following some discussion of secmark integration at the developer summit, 
> > one of the ideas proposed by Joshua (IIRC) was that it would be desirable 
> > to have a separate table for managing the secmark rules.
> > 
> > This is technically possible (and we could also look at adding hooks for 
> > the load_policy permission to be called for manipulating rules in this 
> > table), but probably difficult to justify upstream: you should only do 
> > something in the kernel if it can't be done in userspace.
> > 
> > I think we can make a good argument, though, based on it being for MAC 
> > rules rather than DAC, in that the _type_ of security being managed is 
> > fundamentally different, and that the table is likely being managed in 
> > conjunction with SELinux policy.
> > 
> > Is there a consensus, particularly from distro folk, that having a 
> > separate table would be of great benefit ?  I can post a rudimentary patch 
> > soon, if needed.
> > 
> 
> Is this really needed as long as the distro provides a way to customize
> the iptables rules?

It's not just that.  The reason a new table was proposed was because
people may want to iptables -F and flush their rules.  If the secmark
stuff is on the main tables (filter and nat) that people use it will get
blown away and there will be no automation of a boolean setting you talk
about later.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.