Re: [RFC PATCH v4 0/3] Added new checks for labeled IPsec & SECMARK [en|dis]able

[Paul Moore <paul.moore@hp.com>]

On Sunday 07 October 2007 5:53:11 pm James Morris wrote:
> I think it'd be good to get these into 2.6.24.  Any acks/nacks ?

Technically the ability to dynamically enable/disable the network access 
controls alters user visible behavior and could cause complaints from users.  
Granted, the chance of someone complaining about a missing unlabeled_t access 
check when they haven't explicitly configured labeled networking is pretty 
slim, but it still is possible and I don't want to knowingly cause things to 
break.

It's tempting from a performance point of view to run with this now, but I 
personally tend to think it's best to wait and implement it in policy rev 22 
when we can hide it behind the new capability bitmap field (my thinking is 
that it goes in with the new peer permission class and flow controls).

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.