Re: secmark integration

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

On Mon, 2007-04-02 at 15:15 +0000, Christopher J. PeBenito wrote:
> On Mon, 2007-04-02 at 10:55 -0400, Eric Paris wrote:
> > 
> > Good idea.  Can anyone help me come up with any way in which we can use
> > secmark 'by default' and gain any greater protections than we already
> > have with name_{bind,connect}
> > 
> > Seems to me that port number is the only thing we can label based on for
> > everyone out of the box.  Any more complex labeling scheme is going to
> > require network specific information, right?
> 
> Right.  Refpolicy already can create a set of iptables rules based on
> the ports defined in the policy, but its not currently shipped (which
> was decided at the summit).
> 

I don't think that there are particularly good restrictions that we can
do out of the box. I think that we should instead focus on making it
fairly easy to do customization with some documentation / recipes that
people can follow.

To that end, Chris / Dan, can you comment on my policy example? What I
posted doesn't exactly work now and I would like to know what the
suggested method for allowing almost all network facing daemons to
receive unlabeled_t packets is going to be.

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.