network object

[Alexis Wagner <venon@fugusec.net>]

Hi,

I have some questions about selinux in a labeled network. 

First of all, I have read on the web that network labelling is not 
supported in kernel 2.6 an higher.  I have also read that it will be 
possible to reimplement the necessary features using the packet filter.
Is that true ?

Imagine I want to allow the domain one_t to set up and use  a tcp 
connection with the domain two_t on node two_t.  
Is it the correct way to set up the policy ?

node one  will have the following configuration :
net_contexts  :
        nodecon 10.10.10.2 255.255.255.255 system_u:object_r:node_two_t
one.te :
        allow one_t self:tcp_socket  { create_stream_socket_perms } ;
        allow one_t netif_type:netif  {tcp_recv tcp_send} ;
        allow one_t node_two_t:node {node_bind tcp_send tcp_recv};
        allow one_t port_t:tcp_socket {name_bind  recv_msg send_msg} ;
        allow one_t net_conf_t:file r_file_perms;

        allow one_t kernel_t:tcp_socket {recvfrom } ;
       #Wich domain I put here ? 
        allow one_t ???:tcp_socket {acceptfrom recvfrom } ;

node two will have the following configuration :
net_contexts  :
        nodecon 10.10.10.1 255.255.255.255 system_u:object_r:node_one_t
two.te :
        allow two_t self:tcp_socket  { create_stream_socket_perms } ;
        allow two_t netif_type:netif  {tcp_recv tcp_send} ;
        allow two_t node_one_t:node {node_bind tcp_send tcp_recv};
        allow two_t port_t:tcp_socket {name_bind  recv_msg send_msg} ;
        allow two_t net_conf_t:file r_file_perms;

        allow two_t kernel_t:tcp_socket {recvfrom } ;
       #Wich domain I put here ? 
        allow two_t ???:tcp_socket {acceptfrom recvfrom } ;


It is correct ?

Where could I find more uptodate information about using SELinux in a 
labeled network ?


Thank you,

Alexis Wagner



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.