Re: [RFC 2/7] NetLabel: core network changes

[Steve Grubb <sgrubb@redhat.com>]

On Thursday 22 June 2006 05:00, David Miller wrote:
> >  #define NETLINK_GENERIC              16
> > +#define NETLINK_NETLABEL     17      /* Network packet labeling */
> >  
> >  #define MAX_LINKS 32         
>
> Please use generic netlink.

Since this is a security interface, shouldn't it be its own protocol so that 
SE Linux can control commands being sent? Paul's patches do include a netlink 
table in security/selinux/nlmsgtab.c. But I do not see any hooks to control 
generic netlink messages. (There seems to be several protocols that SE Linux 
is not controlling.) I could see that someone in secadm role should be able 
to issue these commands, but someone at sysadm or auditadm would not.

If moving this over to generic is a must, then I think SE Linux will have to 
clip into generic to control its packet flow.

-Steve


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.