Re: Labeled networking packets

[Paul Moore <paul.moore@hp.com>]

Venkat Yekkirala wrote:
> OK, here's what we will do:
> 
> 1. We will have getpeercon() fail if there's no labeled-SA.

... or NetLabel :)  What do you propose we do if there is both a SA and
NetLabel label, bearing in mind that NetLabel may be a full context?

> 2. We will do a getdatacon() or something similar to retrieve the
>    secmark (as reconciled in the proposed reconciliation logic, of course).

Since the getdatacon *could* change from one packet to the next, I
wonder if it might make more sense to handle the "data context" as an
ancillary messags similar to IP_PASSSEC.

Also, didn't Karl have an objection to the proposed reconciliation logic?

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.