Re: secmark integration

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

On Mon, 2007-04-02 at 15:47 -0400, James Morris wrote:
> On Mon, 2 Apr 2007, Karl MacMillan wrote:
> 
> > I think that controlling port binding plus separating the traffic with
> > secmark will be sufficient in most cases. There is no advantage to
> > replicating the port binding rules with secmark (except perhaps with
> > protocols that connect to random ports like nis or ftp).
> 
> There definitely is, as connection tracking will ensure that only packets 
> which are valid for the connection are labeled appropriately, so you don't 
> need open rules for ephemeral ports etc., as well as the tighter security 
> in general.
> 

I'm not arguing that secmark doesn't have some advantages, particularly
around connection tracking. What I'm saying is that controlling port
binding in the way we currently do is sufficient as a starting point.

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.