Re: Socket and inode label consistency

[Paul Moore <paul.moore@hp.com>]

On Wednesday 27 August 2008 4:06:55 pm Casey Schaufler wrote:
> Yes, it would be weird to change the label on a TCP connection
> midstream, but not unheard of. If you need an example think of
> what you might want to do with a diskless boot, or some of the
> less sophisticated clustering schemes.

Speaking purely in regards to the current Linux implementation, the 
thing that concerns me about stream sockets is that it is difficult, if 
not impossible, to ensure that the relabel happens at a specific data 
boundary in the stream.  Retransmission is another issue but might work 
okay depending where in the kernel the queue/retransmission takes 
place, I would need to check that.  I suppose all of these things can 
be addressed but it would be take a little bit of work and until I see 
an application/user that needs this functionality I can't justify 
spending time on it (my todo list is already way too long).

If you look carefully at the new labeled networking bits for 2.6.28 you 
will see that while we add the ability to change labeling based on the 
destination address, we do not allow labeling to change on an existing 
connection (although you can disconnect and reconnect a socket to a 
different destination allowing you to change the network labeling).

-- 
paul moore
linux @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.