Re: [PATCH 2/7] NetLabel: core network changes

[Paul Moore <paul.moore@hp.com>]

Thomas Graf wrote:
> * Paul Moore <paul.moore@hp.com> 2006-07-28 13:58
> 
>>I'm  a little confused by your comment, could you be a bit more
>>specific?  Are you basing your comment strictly on the text above?  If
>>so, the problem may be my poor excuse for documentation rather then my
>>poor excuse for implementation :)
>>
>>I am using the generic netlink interface, in what I believe to be a
>>"correct" fashion - please correct me if I'm wrong.
> 
> The netlink bits are spread around all patches so I just quoted
> on this comment. By adding functions like netlbl_align(),
> netlbl_put_u8(), netlbl_put_hdr() writing a netlink header
> etc. you are just duplicating the already existing interfaces
> found in net/netlink.h and net/genetlink.h.

Thanks for the clarification, I think I understand your point a bit
better now.

It sounds like you main concern is that I'm not using the netlink
attribute interfaces, yes?  I looked at using those originally but
decided not to use them for the following reasons:

 1. They are listed as "optional" in the documents I read
 2. They add at least an extra 32 bits to each attribute
 3. There seems to be plenty of users in net/ipv4 who do not make
    use of attributes (a *quick* look again reveals none)
 4. Since I'm reading messages from userspace I can't trust the
    message contents regardless of it's use of attributes
 5. Harder to work with in userspace without using a netlink
    library, which would create an extra dependency for tools which
    talk to the NetLabel subsystem

Basically, I saw no requirement to use the netlink attributes and no
advantage so I didn't.  Is this reasonable, or do you feel the use of
attributes is a requirement?

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.