Re: [PATCH 07/10] selinux: Check receiving against sending interface on packet forwarding

[Steffen Klassert <steffen.klassert@secunet.com>]

On Wed, Feb 23, 2011 at 04:34:59PM -0500, Paul Moore wrote:
> 
> > Now __xfrm_route_forward() decodes the sid of the flow with
> > selinux_xfrm_decode_session(). This packet has neither a secpath nor socket
> > conext. So the sid of the flow is decoded to SECSID_NULL.
> 
> I suppose we probably should set the flow's label in this case to 
> SECINITSID_UNLABELED instead of SECSID_NULL, that would be more consistent ... 
> although we would probably need to make sure we don't break anything in 
> selinux_xfrm_state_pol_flow_match().

I think using SECINITSID_UNLABELED instead of SECSID_NULL would break the
netlabel fallback labeling. security_net_peersid_resolve() requires
SECSID_NULL on unlabeled packets.

> 
> I think the problem is that you believe the network interface's label becomes 
> the peer label of unlabeled packets, that is not the case.  If you want to 
> provide a network peer label to unlabeled packets you need to use NetLabel's 
> fallback labeling mechanism which applies peer labels to what would otherwise 
> be unlabeled packets (see an example at the link below).

Ok, I've missed the possibility to relabel unlabeled packets with netlabel.
Knowing about this possibility makes many things clear, thanks for pointing
to it.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.