Re: Would the SELinux act as a TippingPoint IPS to block the nasty Trojan traffic?

[Paul Moore <paul.moore@hp.com>]

On Wednesday, April 11 2007 11:10:16 am Venkat Yekkirala wrote:
> Just FYI-I did propose filtering in the filter table in the past,
> and this has been on my todo list.
>
> "Implementation issues aside, lately I have been wondering about doing
> something in the filter table using something we could call secfilter
> or so.
>
> You would still use secmark to label the packets, but they (along with
> any external labels) could get filtered in the secfilter module. This
> way we could control what external labels could come thru from what peers.
> For internal labels it would be more of an assurance thing. This would also
> automatically take care of forwarding controls."

This is what I was talking about, although I called it "secpoint" (too many 
names <g>).  The approach seemed to have promise in that it seemed to be 
easily understood be everyone and I brought it up again because I didn't want 
it to get lost; the discussion trailed off after initial idea was proposed 
and you hadn't posted anyting regarding it since then.

Do you have an estimate of when you are planning to work on it?  I want to try 
and avoid duplicating our efforts.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.