Re: Iptables discussion

[Daniel J Walsh <dwalsh@redhat.com>]

Network Integration with SELinux, stinks from a users point of view.

Lets look at some potential usage scenarios.

User has two network devices (Internal and External)  He wants to allow 
only Apache to listen on the external device, and only communicate via 
LDAP over the internal device?  How would he set that up?  (IF someone 
says he will rewrite policy, I will scream, and then ask you to write 
policy to allow this. ) 

MLS System, wants to have two Apache systems,  One listening at port 80 
for Top Secret communications, another at port 81 for secret.  How do 
you do this?

You want to setup a Zone Transfer between your two named servers.  You 
want to guarantee that named_t on one machine is talking to named_t on 
another machine over an encrypted line? 

I believe the only way for users to do these things successfully is to 
have integration of SELinux with iptables, and no writing/rewriting of 
policy will solve the problem.

Dan

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.