[PATCH 0/5] NetLabel reference policy patches

["Paul Moore" <paul.moore@hp.com>]

This patchset does two main things:

 1. Converts the unused netmsg initial SID into the base NetLabel SID
 2. Adds NetLabel corenet policy interface calls into those domains which
    require network access

The basic idea behind this change to the policy has been discussed on this
list before, but as a recap, the motivating force behind the change in #1 is
the ability to easily allow/disallow NetLabel labeled/unlabeled traffic on
a per-domain basis.

I've also just reposted the current kernel patch for reference in examining
this patchset.  While testing every single modified domain in this patchset
is almost impossible for little 'ole me I have run this policy on a recent
Fedora Rawhide system using the patched kernel and have not seen any
"{tcp,udp,rawip}_socket recvfrom" AVC denials during boot or normal operation.

Please consider these patches for inclusion into the Reference Policy.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.