Proposal for increasing the granularity of "setopt"

[Paul Moore <paul.moore@hp.com>]

Before I go ahead and write any code I was wondering if there would be
any objections to increasing the granularity of the "setopt" permission
for sockets.  Right now it is not possible to differentiate between a
domain wanting to adjust the TCP socket options and a domain wanting to
adjust the IP socket options.  Probably not a big deal but this is a bit
of a concern for the CIPSO/NetLabel code as it relies heavily on socket
options.

I would like to propose introducing a new permission "setopt_ip" which
would allow domains to set IP level socket options.  This could also be
extended with "setopt_ipv6", "setopt_tcp", "setopt_udp", etc.  All calls
to setsockopt() with levels not protected by unique permissions would be
protected by the existing "setopt" permission.  Does that sound reasonable?

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.