[PATCH 0/7] secid reconciliation-v02: Repost patchset with updates

[PATCH 0/7] secid reconciliation-v02: Repost patchset with updates

[Venkat Yekkirala]

The following are the changes included in this patchset since the previous post:

- Perform flow_in check before (as opposed to after) computing transition
  secid on inbound; this seems more intuitive and correct.
- Implement reconciliation and flow control for outbound traffic
  (forward case being a sequence of inbound checks followed by outbound checks).
- Make selinux_xfrm_postroute_last checks conditional on compat_net.

This patchset is relative to David Miller's net-2.6.19.git (last updated on Sep 1st).

Please consider for inclusion in 2.6.19.


UPCOMING WORK:

The following per the discussion at:
  http://marc.theaimsgroup.com/?l=selinux&m=115755980516072&w=2

- Create IPSec SAs to be acquired with the creating sock's context as opposed
  to that of the matching SPD rule, resulting in a simpler SPD as well as policy.
- Set peer_sid on tcp sockets to the reconciled secmark so trusted applications
  can retrieve and service the data at the appropriate context.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[PATCH 0/7] secid reconciliation-v02: Repost patchset with updates

[Venkat Yekkirala]

The following are the changes included in this patchset since the previous post:

- Perform flow_in check before (as opposed to after) computing transition
  secid on inbound; this seems more intuitive and correct.
- Implement reconciliation and flow control for outbound traffic
  (forward case being a sequence of inbound checks followed by outbound checks).
- Make selinux_xfrm_postroute_last checks conditional on compat_net.

This patchset is relative to David Miller's net-2.6.19.git (last updated on Sep 1st).

Please consider for inclusion in 2.6.19.


UPCOMING WORK:

The following per the discussion at:
  http://marc.theaimsgroup.com/?l=selinux&m=115755980516072&w=2

- Create IPSec SAs to be acquired with the creating sock's context as opposed
  to that of the matching SPD rule, resulting in a simpler SPD as well as policy.
- Set peer_sid on tcp sockets to the reconciled secmark so trusted applications
  can retrieve and service the data at the appropriate context.

Re: [PATCH 0/7] secid reconciliation-v02: Repost patchset with updates

[Paul Moore]

On Friday 08 September 2006 12:50 pm, Venkat Yekkirala wrote:
> UPCOMING WORK:
>
> The following per the discussion at:
>   http://marc.theaimsgroup.com/?l=selinux&m=115755980516072&w=2
>
> - Create IPSec SAs to be acquired with the creating sock's context as
> opposed to that of the matching SPD rule, resulting in a simpler SPD as
> well as policy. - Set peer_sid on tcp sockets to the reconciled secmark so
> trusted applications can retrieve and service the data at the appropriate
> context.

Considering the discussions that have taken place on the SELinux list I think 
doing the work to set the peer_sid value on TCP sockets is an important part 
of the secid work and should be included in this patchset.  I don't believe 
it would be that difficult, and it would make some of the code much 
cleaner/simpler I think.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH 0/7] secid reconciliation-v02: Repost patchset with updates

[Paul Moore]

On Friday 08 September 2006 12:50 pm, Venkat Yekkirala wrote:
> UPCOMING WORK:
>
> The following per the discussion at:
>   http://marc.theaimsgroup.com/?l=selinux&m=115755980516072&w=2
>
> - Create IPSec SAs to be acquired with the creating sock's context as
> opposed to that of the matching SPD rule, resulting in a simpler SPD as
> well as policy. - Set peer_sid on tcp sockets to the reconciled secmark so
> trusted applications can retrieve and service the data at the appropriate
> context.

Considering the discussions that have taken place on the SELinux list I think 
doing the work to set the peer_sid value on TCP sockets is an important part 
of the secid work and should be included in this patchset.  I don't believe 
it would be that difficult, and it would make some of the code much 
cleaner/simpler I think.

-- 
paul moore
linux security @ hp