Re: Labeled networking packets

[Paul Moore <paul.moore@hp.com>]

Venkat Yekkirala wrote:
>>bah, fair enough :\. I guess the reason I was objecting was 
>>because the
>>objects seem *very* different. standard object and subject transitions
>>seem pretty intuitive (I'm in a domain, i execute something, I'm in a
>>new domain or directories containing files guiding 
>>transitions. packets
>>and associations are totally separate and used for totally different
>>things. And the other problem was that I don't even know if we were
>>*trying* to derive a subject label or not, some of the examples I've
>>seen floating around indicate that others don't either.
>  
> You can always have getpeercon return a "domain" by turning out a
> domain (a unlabeled_t one?) in the non labeled-ipsec case.

The only thing I don't like about this is that it starts giving
types/domains implicit meaning that is not defined by policy.  I know we
sort of do that already with some of the MLS attributes but I think it's
worth trying to avoid.

Plus, what if the remote domain was honestly running in "unlabeled_t"?
Stupid, yes, but possibile I imagine.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.