Re: [RFC 0/5] Static/fallback external labels for NetLabel

[Paul Moore <paul.moore@hp.com>]

On Tuesday, August 28 2007 12:18:05 pm Joe Nall wrote:
> On Aug 28, 2007, at 10:51 AM, Paul Moore wrote:
> > Hmm, so in summary, you (TCS) don't see a need for flow control of
> > fallback
> > labels with granularity greater then a single host and if really
> > pushed
> > interface level granularity would most likely suffice.  I'll
> > venture that
> > host/network level granularity might be nice for normal users who
> > only have
> > one interface which connects to multiple networks, e.g. the person
> > sitting at
> > home on a private home network which also connects to the big-bad-
> > internet
> > via a nat box provided by their ISP.
>
> This matches my CMW experience. Interface labeling is a must. Per
> host/net
> default labeling is very useful, but isn't a show-stopper. Per host/net
> default labeling is particularly useful when testing since most of us
> don't
> have a a dozen physical interfaces and associated infrastructure for
> test.

That's good to know others have the same needs/requirements.  We've been going 
around in circles for a while now but I think we are finally starting to 
settle on what we need.

> Will interface aliases (eth0:1) be able to take on different labels from
> their base interface?

Not sure, it all depends on if an interface alias ends up creating a separate 
net_device struct in the kernel, I don't have the answer to this off the top 
of my head.  What is your preference?

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.