Re: [RFC] use the netmsg initial SID for NetLabel connections

[Paul Moore <paul.moore@hp.com>]

On Tuesday, June 12 2007 8:12:16 am Christopher J. PeBenito wrote:
> On Fri, 2007-06-08 at 09:58 -0400, Paul Moore wrote:
> > I still have a question about the best way to provide both labeled and
> > unlabeled NetLabel support to all of the user/application domains in the
> > policy.  I don't have a problem going through all the individual domains
> > and adding calls like these:
> >
> >   corenet_{tcp,udp,raw}_recv_unlabeled(<domain>)
> >   corenet_{tcp,udp,raw}_recv_netlabel(<domain>)
> >
> > ... but I was wondering if there was another way I should go about making
> > the change?
>
> No, that's the right method.  I've been thinking about if this is the
> right vocabulary for the interfaces; I'd like to make it workable for
> labeled ipsec too.

Yes, especially for the unlabeled case.  I would think having a single 
interface to allow a domain to receive unlabeled traffic would be much better 
than two.

> The problem is that ipsec is a little different, 
> where you might have interfaces like apache_tcp_recvfrom_user_script().

Yes, you also have all the SPD matching issues to deal with.  Hopefully later 
this year I'll have NetLabel supporting full SELinux contexts which should 
make NetLabel and IPsec very similar in regards to packet subject/object 
labels; the class/permissions will still be different but that is more of an 
interface implementation issue than an actual interface/API issue.

Thanks for you help, I'll hope to have a patch for you to review within a week 
or two that adds the corenet/NetLabel interfaces to the policy in SVN.  I'd 
like to get this accepted and merged before I push the final kernel patch up 
to James/Stephen as the kernel changes require a new/updated policy to work 
correctly.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.