Re: secmark integration

[Paul Moore <paul.moore@hp.com>]

On Friday, March 30 2007 10:09:45 pm James Morris wrote:
> On Fri, 30 Mar 2007, Eric Paris wrote:
> > > Is this really needed as long as the distro provides a way to customize
> > > the iptables rules?
> >
> > It's not just that.  The reason a new table was proposed was because
> > people may want to iptables -F and flush their rules.  If the secmark
> > stuff is on the main tables (filter and nat) that people use it will get
> > blown away and there will be no automation of a boolean setting you talk
> > about later.
>
> I think there's also a good case for a separate table on the basis that
> the rules are part of a separate administrative realm (e.g. MAC, rather
> than DAC) and should be maintained separately.  We could also look at
> adding an LSM hook for rules being manipulated in this table (perhaps
> called 'security' to be more general).

I agree that if we add a new table it should be a generic security/lsm table.  
While presently only secmark would make use of it; the iptables in/out/fwd 
checks for externally labeled packets discussed most recently at the 
developer's summit could also make use of the same table for the same reasons 
as secmark.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.