Re: MCS and default labels

[Paul Moore <paul.moore@hp.com>]

On Tuesday 29 September 2009 11:51:42 pm Kyle Moffett wrote:
> Basically, my end goal is to be able to have a network of Linux boxes
> (with the network itself being "s4", for example) and *guarantee*
> that:

Thanks for the clarification; I'm pretty sure we can get something working.
 
>  (A)  Any unlabelled data coming in off the network is treated by SELinux
>  is s4

You can either provide special handling for this in your application(s) or you 
can configure the kernel to return a static label for unlabeled traffic.  
Personally I think it would be easier to just configure the kernel to do it 
for you, but if you have a custom app, maybe not ...

 * http://paulmoore.livejournal.com/1758.html

>  (B)  No processes are allowed to communicate out the network
> unprotected unless they are exactly s4

It should be possible to configure the SPD and write policy such that the "no 
IPsec" SPD rule only matches traffic from "s4" labeled sockets, then all you 
need to do is add a catch-all SPD rule to wrap with ESP/AH (or drop) all 
traffic not explicitly specified in the SPD.

I haven't tried this personally, but I don't see any reason why it wouldn't 
work (and I would consider it a bug if it didn't).

>  (C)  Processes which are *not* s4 may communicate over the network
> only when protected by IPsec, and only if the IPsec connection is
> specifically negotiated using certificates/keys based on the level of
> the data being protected.

I think the tricky part here is the "... certificates/keys based on the level 
of the data ..." statement.  Is is sufficient to have one certificate per 
host/node as long as you have one SA per label?

-- 
paul moore
linux @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.