Re: ipsec, netlabels, secmark- How about a little usability?

[Joshua Brindle <jbrindle@tresys.com>]

Joshua Brindle wrote:
> Daniel J Walsh wrote:
>> =======================================================
>>
>> If someone was to pass a law and make me the King of SELinux, The way 
>> this would happen is that iptables would be extended to add a -t 
>> SecurityContext flag, which I then could simple SELinux rules to set 
>> this up in a lanquage that most Sysadmins of Linux boxes could 
>> readily understand.
> umm, -j SECMARK --selctx?
>
Actually I see what you are saying now, you want to match based on 
context, not label packets. This is not in the spirit of SELinux because 
it spreads the policy out into 2 places and makes it much harder to 
audit. We want labeling spread out but policy centralized.

It would make management of the policy even harder than it is now.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.