From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from jazzdrum.ncsc.mil (zombie.ncsc.mil [144.51.88.131]) by tarius.tycho.ncsc.mil (8.13.1/8.13.1) with ESMTP id k5R2jCj0008199 for ; Mon, 26 Jun 2006 22:45:12 -0400 Received: from mailhub.hp.com (jazzdrum.ncsc.mil [144.51.5.7]) by jazzdrum.ncsc.mil (8.12.10/8.12.10) with ESMTP id k5R2jAdE003146 for ; Tue, 27 Jun 2006 02:45:10 GMT From: Paul Moore To: James Morris Subject: Re: [redhat-lspp] Re: [RFC 3/7] NetLabel: CIPSOv4 engine Date: Mon, 26 Jun 2006 22:45:02 -0400 Cc: Joe Nall , David Miller , jmorris@redhat.com, Stephen Smalley , RedHat LSPP , linux-security-module@vger.kernel.org, SELinux List , netdev@vger.kernel.org, Steve Grubb References: <20060621194234.979661000@flek.zko.hp.com> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Message-Id: <200606262245.03628.paul.moore@hp.com> Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov On Monday 26 June 2006 8:33 pm, James Morris wrote: > On Mon, 26 Jun 2006, Joe Nall wrote: > > For all of the EAL4 LSPP Linux evaluation work is being done by Red > > Hat/IBM/HP/atsec and others to be useful to integrators, there has to be > > basic (e.g. CIPSO) multilevel network interoperability with existing > > multilevel systems and good (e.g IPSec) multilevel networking between > > SELinux systems. > > Just to be clear, my understanding is that the native xfrm labeling is > suitable for LSPP evaluation, as distinct from CIPSO being desired by > system integrators from an interoperability point of view. > True, but I believe the point Joe was trying to make was that providing support for only one labeling mechanism would limit the usefulness of the evaluated configuration. What good is a Common Criteria evaluation if it doesn't contain the features that user's require? -- paul moore linux security @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: [redhat-lspp] Re: [RFC 3/7] NetLabel: CIPSOv4 engine Date: Mon, 26 Jun 2006 22:45:02 -0400 Message-ID: <200606262245.03628.paul.moore@hp.com> References: <20060621194234.979661000@flek.zko.hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Cc: Joe Nall , David Miller , jmorris@redhat.com, Stephen Smalley , RedHat LSPP , linux-security-module@vger.kernel.org, SELinux List , netdev@vger.kernel.org, Steve Grubb Return-path: To: James Morris In-Reply-To: Content-Disposition: inline Sender: linux-security-module-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Monday 26 June 2006 8:33 pm, James Morris wrote: > On Mon, 26 Jun 2006, Joe Nall wrote: > > For all of the EAL4 LSPP Linux evaluation work is being done by Red > > Hat/IBM/HP/atsec and others to be useful to integrators, there has to be > > basic (e.g. CIPSO) multilevel network interoperability with existing > > multilevel systems and good (e.g IPSec) multilevel networking between > > SELinux systems. > > Just to be clear, my understanding is that the native xfrm labeling is > suitable for LSPP evaluation, as distinct from CIPSO being desired by > system integrators from an interoperability point of view. > True, but I believe the point Joe was trying to make was that providing support for only one labeling mechanism would limit the usefulness of the evaluated configuration. What good is a Common Criteria evaluation if it doesn't contain the features that user's require? -- paul moore linux security @ hp