Re: Labeled networking packets

[Paul Moore <paul.moore@hp.com>]

Venkat Yekkirala wrote:
>>Venkat Yekkirala wrote:
>>>>>Do you have a scenario where one might want both labeling 
>>>>
>>>>schemes at the
>>>>
>>>>
>>>>>same time? Note that if you need netlabel (legacy os on the 
>>>>
>>>>other side)
>>>>
>>>>
>>>>>and you also want ipsec for integrity then the isakmp 
>>>>
>>>>negotiation would
>>>>
>>>>
>>>>>not include a context and netlabel would be used.
>>>>
>>>>Honestly, I can't think of why you would want to use both SA and
>>>>NetLabel labeling on the same connection - that's just stupid :)
>>>
>>>I can think of ALL Secret and its compartments using one SA
>>>for example (a very realistic one).
>>
>>If you have NetLabel carrying the MLS label why would you want to make
>>your life complicated by using SA labeling as well?
>  
> It's not a matter of complicated or not. Unless you make sure both
> are NOT used at the same time, you *must* make you they work like
> they are supposed to (cipso falling in the rage of the SA) if/when
> they are used together.

See my comments in my other mail about treating the socket as the
communication endpoint, not the SA.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.