Re: [RFC PATCH 2/2] [SELINUX] Better integration between peer labeling subsystems

[Paul Moore <paul.moore@hp.com>]

On Tuesday 25 September 2007 6:38:37 pm James Morris wrote:
> On Tue, 25 Sep 2007, Paul Moore wrote:
> > +int security_sid_mls_cmp(u32 sid_a, u32 sid_b)
>
> This looks heavyweight on TCP connection establishment (MCS is enabled in
> Fedora/RHEL).

Agreed.  That is why it is only executed when both NetLabel and labeled IPsec 
peer labels are present on the same packet/connection.  A situation which I 
expect to be extremely unlikely for a variety of reasons so I don't think 
this will be a problem in the general case.

In the case where we have two types of peer labels on a packet, the TCS folks 
expressed a concern (which makes sense to me) that we could run into a 
problem where the two peer labels might not match.  This is an attempt to 
address that problem, I'm always open to suggestions for better ways to solve 
the problem.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.