Re: Denials from newest kernel

[Paul Moore <paul.moore@hp.com>]

On Saturday 14 October 2006 3:36 am, James Morris wrote:
> On Fri, 13 Oct 2006, Paul Moore wrote:
> > 1. The skb->secmark field should only be used for local/netfilter packet
> > labeling, neither labeled IPsec or NetLabel should ever change it's
> > value.
>
> Yep, this may be the best way forward.  They really are different types of
> labeling.  I previously mentioned a way to _internally_ have the secmark
> field carry multiple distinct labels (assign half to external labeling
> and half to internal, and transparently perform mapping so that userland
> tools always deal with the internal label only).  Perhaps this needs to be
> part of the solution.

If we had more bits in the secmark field I would agree with you (and maybe 
this is the way the community wants to go, time will tell) but I tend to 
think that 32 bits may already be a constraint at some point in the future so 
I'm hesitant to further restrict ourselves.

I think one thing to remember is that all of the external labeling mechanisms 
in use right now already have a way to carry a SID for the life of the 
sk_buff, it may just not be stored in the sk_buff struct itself.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.