Re: Would the SELinux act as a TippingPoint IPS to block the nasty Trojan traffic?

[Paul Moore <paul.moore@hp.com>]

On Tuesday, April 10 2007 10:58:13 pm Joshua Brindle wrote:
> >> I'd love to see your suggestions on solving the forwarding problem, I
> >> suppose those are forthcoming? :)
> >
> > Right now you'll have to make do with the discussion from the developer's
> > summit and my lovely emails ;)  The patches will be forthcoming but I
> > need to wrap up some loose ends on another project right now ..
>
> for some reason I don't remember a design being discussed at the summit,
> I'm probably just forgetting. This is not secpoint based right?

It was discussed but towards the end of the day in the networking discussion 
block.  See the notes that Stephen posted a while ago.

The idea is to create a new iptables "target" (probably the wrong term, but 
I'm not an iptables expert ... yet) which had an assigned label, you would 
then create iptables rules which would match certain traffic to 
that "target".  The packets which hit the "target" would have an access check 
similar to the following:

 allow <target_label> <external_packet_label> : class perm;

So it's very similar to the secpoint (or whatever it was being called) idea.  
Also, just to re-iterate this - I HAVE NO PLANS TO MERGE THE INTERNAL AND 
EXTERNAL LABELS.  The original intent is to only provide support for 
external, i.e. NetLabel and labeled IPsec, labeling mechanisms; if we decide 
to provide support for internal labeling mechanisms like SECMARK we will do 
so in parallel with additional access checks.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.