Re: [PATCH 4/4] REFPOL: Add new labeled networking permissions

[Paul Moore <paul.moore@hp.com>]

On Thursday 14 February 2008 9:36:59 am Christopher J. PeBenito wrote:
> On Wed, 2008-02-13 at 22:54 -0500, Paul Moore wrote:
> > On Tuesday 12 February 2008 9:39:59 am Christopher J. PeBenito 
wrote:
> > > On Fri, 2008-02-08 at 16:25 -0500, paul.moore@hp.com wrote:
> > > > plain text document attachment (refpol-peer_perms)
> > > > The 2.6.25 kernel will introduce a new set of labeled
> > > > networking controls to SELinux and this patch makes the
> > > > necessary changes to the Reference Policy to support unlabeled
> > > > network traffic with the new controls.
> > >
> > > The corenetwork part is missing changes in the cornetwork.if.m4
> > > file. Thats where the interfaces generated by a
> > > network_(node|interface)() are generated.
> >
> > Okay, I'll look into fixing that part up.
> >
> > > I'm not so sure about the kernel interface changes.  The docs
> > > probably should be revised, its more about using sockets whose
> > > types have been invalidated.  It doesn't have anything to do with
> > > unlabeled networking.
> >
> > Hmmm, okay.  Do you have a suggestion for how to add these new
> > allow rules?  A new interface?  I would need to go check again, but
> > these seemed to be the most logical of the existing interfaces when
> > I made the change (and I suspect not much has changed in this
> > area).
>
> I'm thinking along the lines of new interfaces like
> kernel_recvfrom_unlabeled_peer().

Okay, I'll see what I can do.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.