Re: ipsec, netlabels, secmark- How about a little usability?

[Joshua Brindle <jbrindle@tresys.com>]

Venkat Yekkirala wrote:
>> We have been having some meetings to discuss how we can use 
>> this stuff 
>> in the real world (IE Non MLS), and I think the current 
>> implementation 
>> is coming up short.  The discussions I have seen have talked 
>> about using 
>> getpeercon to look at the other end of the connections, but 
>> this is not 
>> in the spirit of SELinux where modification of the 
>> applications should 
>> not be necessary to secure the environment.
>>
>>     
>
>
> So, what happens if an externally labeled packet (e.g.: Labeled IPSec)
> comes in thru the above entry point? First of all, a check is made to
> see if a packet so labeled using IPSec (unlabeled if no IPSec) can
> "flow in" thru the "entry point". If it can, and if there's an
> IPSec label on the packet, a transition sid is computed between the
> "entry point" label and the IPSec label and the packet will be marked
> with this transition sid. The transition label will either be the IPSec
> label (default) or any other label as defined by SELinux policy transition
> rules.
>
>   
What if there are 2 external labels (ipsec and cipso) ?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.