Re: [PATCH 0/6] netfilter integration

[Joshua Brindle <jbrindle@tresys.com>]

Casey Schaufler wrote:
> 
> --- "Christopher J. PeBenito" <cpebenito@tresys.com>
> wrote:
> 
>> This patchset adds support for netfilter secmark
>> rules in all policy
>> packages.  Each line of the file has a priority
>> (1-9) at the beginning
>> of the line, and the remainder is treated as the
>> rule.  Sorting is by
>> priority (1-9), and is stable within a module.  The
>> current design is
>> for the resultant netfilter_contexts file be
>> suitable for use with
>> iptables-restore.
> 
> How confident are you that 9 priorities
> will be sufficient? I can easily imaging
> dependency scenarios that would exceed
> this limitation. I would also expect that
> explict ordering within a priority is 
> going to be requested as soon as this
> goes into production.
> 
in reality probably 3 priorities would be sufficient. Specific port, 
port range and fallback. Its very doubtful that anything else would be 
necessary, especially in modules where the priority is much more 
important than in base. A module will very rarely have something more 
specific than ports, and since ports are non-overlapping it doesn't 
matter what order they are in (within a single priority)

> Speaking of dependencies, wouldn't a
> mechanism to declare dependencies a'la
> make be more precise? Just a thought.
> 
> 
eh? Policy modules already declare symbol dependencies explicitly (eg., 
which types, roles, etc this module uses)

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.