Backwards compatibility (proposal for a new compat_net like flag)

[Paul Moore <paul.moore@hp.com>]

As you may have noticed there has been a _lot_ of discussion lately about the 
labeled networking functionality in SELinux and how to both improve the 
existing functionality as well as introduce new functionality to enable 
SELinux to be used in more and more places.  Several different things were 
debated including fallback peer labels, packet flow control, loopback 
labeling, and the use of unified access checks for the different peer 
labeling mechanisms (NetLabel, labeled IPsec).

While it should be possible to implement some of the new ideas while retaining 
backwards compatibility (fallback labels, loopback labeling) some other ideas 
would most likely introduce problems when used with older policy (packet flow 
control, unified access checks).  Unfortunately, as discussed numerous times 
before, we don't presently have a good way to select kernel behavior at 
runtime and if we want to move forward with some of the new labeled 
networking ideas we need a way to preserve the existing behavior.

To help solve this problem I'd like to propose we introduce a new tunable, 
similar to the existing compat_net flag, but instead of it being a simple 
boolean value I would like to implement it as an integer value.  This new 
tunable, let's call it "select_net", would act as a versioning value for the 
network access controls.  The existing behavior would be used when 
select_net==0 and the new behavior would be used when select_net==1; if we 
needed to introduce new checks in the future which could break compatibility 
we only enable them when select_net==2.

Thoughts?  It's not perfect, I know, but I'd like to be able to start moving 
forward with some of these labeled networking changes but the compatibility 
concerns are crippling us ...

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.