* Re: [PATCH 1/1] secid reconcialiation: Replace unlabeled_t with the network_t
@ 2006-10-04 14:33 ` Paul Moore
0 siblings, 0 replies; 10+ messages in thread
From: Paul Moore @ 2006-10-04 14:33 UTC (permalink / raw)
To: Venkat Yekkirala; +Cc: netdev, selinux, jmorris, sds, eparis
Venkat Yekkirala wrote:
> The following replaces unlabeled_t with network_t for
> better characterization of the flow out/in checks in
> SELinux, as well as to allow for mls packets to
> flow out/in from the network since network_t would allow
> the full range of MLS labels, as opposed to the unlabeled init sid
> that only allows system-hi.
>
> Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
> ---
> This is an incremental patch the secid-reconcilation v4 patchset.
>
> --- net-2.6.sid3/security/selinux/hooks.c 2006-10-01 15:43:12.000000000 -0500
> +++ net-2.6/security/selinux/hooks.c 2006-10-03 16:43:21.000000000 -0500
> @@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
> err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
> BUG_ON(err);
>
> - err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
> + err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
> + SECCLASS_PACKET,
> PACKET__FLOW_IN, NULL);
> if (err)
> goto out;
> @@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
> skb->secmark = sksec->sid;
> }
> }
> - err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
> + err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
> SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
> }
> out:
Considering the above change, I wonder if it would also make sense to
update the secmark to SECINITSID_UNLABELED in the abscence of any
external labeling (labeled IPsec or NetLabel)?
--
paul moore
linux security @ hp
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 1/1] secid reconcialiation: Replace unlabeled_t with the network_t
2006-10-04 14:33 ` Paul Moore
@ 2006-10-04 14:43 ` Paul Moore
-1 siblings, 0 replies; 10+ messages in thread
From: Paul Moore @ 2006-10-04 14:43 UTC (permalink / raw)
To: Paul Moore; +Cc: Venkat Yekkirala, netdev, selinux, jmorris, sds, eparis
Paul Moore wrote:
> Venkat Yekkirala wrote:
>
>>The following replaces unlabeled_t with network_t for
>>better characterization of the flow out/in checks in
>>SELinux, as well as to allow for mls packets to
>>flow out/in from the network since network_t would allow
>>the full range of MLS labels, as opposed to the unlabeled init sid
>>that only allows system-hi.
>>
>>Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
>>---
>>This is an incremental patch the secid-reconcilation v4 patchset.
>>
>>--- net-2.6.sid3/security/selinux/hooks.c 2006-10-01 15:43:12.000000000 -0500
>>+++ net-2.6/security/selinux/hooks.c 2006-10-03 16:43:21.000000000 -0500
>>@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
>> err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
>> BUG_ON(err);
>>
>>- err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
>>+ err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
>>+ SECCLASS_PACKET,
>> PACKET__FLOW_IN, NULL);
>> if (err)
>> goto out;
>>@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
>> skb->secmark = sksec->sid;
>> }
>> }
>>- err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
>>+ err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
>> SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
>> }
>> out:
>
>
> Considering the above change, I wonder if it would also make sense to
> update the secmark to SECINITSID_UNLABELED in the abscence of any
> external labeling (labeled IPsec or NetLabel)?
>
Ungh, my apologies ... I meant to say "SECINITSID_NETMSG" *not*
"SECINITSID_UNLABELED".
--
paul moore
linux security @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 1/1] secid reconcialiation: Replace unlabeled_t with the network_t
@ 2006-10-04 14:43 ` Paul Moore
0 siblings, 0 replies; 10+ messages in thread
From: Paul Moore @ 2006-10-04 14:43 UTC (permalink / raw)
To: Paul Moore; +Cc: Venkat Yekkirala, netdev, selinux, jmorris, sds, eparis
Paul Moore wrote:
> Venkat Yekkirala wrote:
>
>>The following replaces unlabeled_t with network_t for
>>better characterization of the flow out/in checks in
>>SELinux, as well as to allow for mls packets to
>>flow out/in from the network since network_t would allow
>>the full range of MLS labels, as opposed to the unlabeled init sid
>>that only allows system-hi.
>>
>>Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
>>---
>>This is an incremental patch the secid-reconcilation v4 patchset.
>>
>>--- net-2.6.sid3/security/selinux/hooks.c 2006-10-01 15:43:12.000000000 -0500
>>+++ net-2.6/security/selinux/hooks.c 2006-10-03 16:43:21.000000000 -0500
>>@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
>> err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
>> BUG_ON(err);
>>
>>- err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
>>+ err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
>>+ SECCLASS_PACKET,
>> PACKET__FLOW_IN, NULL);
>> if (err)
>> goto out;
>>@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
>> skb->secmark = sksec->sid;
>> }
>> }
>>- err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
>>+ err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
>> SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
>> }
>> out:
>
>
> Considering the above change, I wonder if it would also make sense to
> update the secmark to SECINITSID_UNLABELED in the abscence of any
> external labeling (labeled IPsec or NetLabel)?
>
Ungh, my apologies ... I meant to say "SECINITSID_NETMSG" *not*
"SECINITSID_UNLABELED".
--
paul moore
linux security @ hp
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 1/1] secid reconcialiation: Replace unlabeled_t with the network_t
2006-10-04 14:33 ` Paul Moore
@ 2006-10-04 14:47 ` Christopher J. PeBenito
-1 siblings, 0 replies; 10+ messages in thread
From: Christopher J. PeBenito @ 2006-10-04 14:47 UTC (permalink / raw)
To: Paul Moore; +Cc: Venkat Yekkirala, netdev, selinux, jmorris, sds, eparis
On Wed, 2006-10-04 at 10:33 -0400, Paul Moore wrote:
> Venkat Yekkirala wrote:
> > The following replaces unlabeled_t with network_t for
> > better characterization of the flow out/in checks in
> > SELinux, as well as to allow for mls packets to
> > flow out/in from the network since network_t would allow
> > the full range of MLS labels, as opposed to the unlabeled init sid
> > that only allows system-hi.
> >
> > Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
> > ---
> > This is an incremental patch the secid-reconcilation v4 patchset.
> >
> > --- net-2.6.sid3/security/selinux/hooks.c 2006-10-01 15:43:12.000000000 -0500
> > +++ net-2.6/security/selinux/hooks.c 2006-10-03 16:43:21.000000000 -0500
> > @@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
> > err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
> > BUG_ON(err);
> >
> > - err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
> > + err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
> > + SECCLASS_PACKET,
> > PACKET__FLOW_IN, NULL);
> > if (err)
> > goto out;
> > @@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
> > skb->secmark = sksec->sid;
> > }
> > }
> > - err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
> > + err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
> > SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
> > }
> > out:
>
> Considering the above change, I wonder if it would also make sense to
> update the secmark to SECINITSID_UNLABELED in the abscence of any
> external labeling (labeled IPsec or NetLabel)?
Wouldn't that make secmark useless in the non labeled networking case?
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 1/1] secid reconcialiation: Replace unlabeled_t with the network_t
@ 2006-10-04 14:47 ` Christopher J. PeBenito
0 siblings, 0 replies; 10+ messages in thread
From: Christopher J. PeBenito @ 2006-10-04 14:47 UTC (permalink / raw)
To: Paul Moore; +Cc: Venkat Yekkirala, netdev, selinux, jmorris, sds, eparis
On Wed, 2006-10-04 at 10:33 -0400, Paul Moore wrote:
> Venkat Yekkirala wrote:
> > The following replaces unlabeled_t with network_t for
> > better characterization of the flow out/in checks in
> > SELinux, as well as to allow for mls packets to
> > flow out/in from the network since network_t would allow
> > the full range of MLS labels, as opposed to the unlabeled init sid
> > that only allows system-hi.
> >
> > Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
> > ---
> > This is an incremental patch the secid-reconcilation v4 patchset.
> >
> > --- net-2.6.sid3/security/selinux/hooks.c 2006-10-01 15:43:12.000000000 -0500
> > +++ net-2.6/security/selinux/hooks.c 2006-10-03 16:43:21.000000000 -0500
> > @@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
> > err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
> > BUG_ON(err);
> >
> > - err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
> > + err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
> > + SECCLASS_PACKET,
> > PACKET__FLOW_IN, NULL);
> > if (err)
> > goto out;
> > @@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
> > skb->secmark = sksec->sid;
> > }
> > }
> > - err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
> > + err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
> > SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
> > }
> > out:
>
> Considering the above change, I wonder if it would also make sense to
> update the secmark to SECINITSID_UNLABELED in the abscence of any
> external labeling (labeled IPsec or NetLabel)?
Wouldn't that make secmark useless in the non labeled networking case?
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 1/1] secid reconcialiation: Replace unlabeled_t with the network_t
2006-10-04 14:47 ` Christopher J. PeBenito
@ 2006-10-04 14:53 ` Paul Moore
-1 siblings, 0 replies; 10+ messages in thread
From: Paul Moore @ 2006-10-04 14:53 UTC (permalink / raw)
To: Christopher J. PeBenito
Cc: Venkat Yekkirala, netdev, selinux, jmorris, sds, eparis
Christopher J. PeBenito wrote:
> On Wed, 2006-10-04 at 10:33 -0400, Paul Moore wrote:
>
>>Venkat Yekkirala wrote:
>>
>>>The following replaces unlabeled_t with network_t for
>>>better characterization of the flow out/in checks in
>>>SELinux, as well as to allow for mls packets to
>>>flow out/in from the network since network_t would allow
>>>the full range of MLS labels, as opposed to the unlabeled init sid
>>>that only allows system-hi.
>>>
>>>Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
>>>---
>>>This is an incremental patch the secid-reconcilation v4 patchset.
>>>
>>>--- net-2.6.sid3/security/selinux/hooks.c 2006-10-01 15:43:12.000000000 -0500
>>>+++ net-2.6/security/selinux/hooks.c 2006-10-03 16:43:21.000000000 -0500
>>>@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
>>> err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
>>> BUG_ON(err);
>>>
>>>- err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
>>>+ err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
>>>+ SECCLASS_PACKET,
>>> PACKET__FLOW_IN, NULL);
>>> if (err)
>>> goto out;
>>>@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
>>> skb->secmark = sksec->sid;
>>> }
>>> }
>>>- err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
>>>+ err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
>>> SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
>>> }
>>> out:
>>
>>Considering the above change, I wonder if it would also make sense to
>>update the secmark to SECINITSID_UNLABELED in the abscence of any
>>external labeling (labeled IPsec or NetLabel)?
>
> Wouldn't that make secmark useless in the non labeled networking case?
>
Sorry, I didn't do a very good job explaining things in my first email
so let me try it again ...
If there is no external labeling, i.e. labeled IPsec or NetLabel, *and*
the secmark is equal to zero/SECSID_NULL I think it might be a good idea
to set the secmark to SECINITSID_NETMSG.
This not affect either local or external labels if they are present, but
if both are not it would give the secmark some meaningful value.
--
paul moore
linux security @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 1/1] secid reconcialiation: Replace unlabeled_t with the network_t
@ 2006-10-04 14:53 ` Paul Moore
0 siblings, 0 replies; 10+ messages in thread
From: Paul Moore @ 2006-10-04 14:53 UTC (permalink / raw)
To: Christopher J. PeBenito
Cc: Venkat Yekkirala, netdev, selinux, jmorris, sds, eparis
Christopher J. PeBenito wrote:
> On Wed, 2006-10-04 at 10:33 -0400, Paul Moore wrote:
>
>>Venkat Yekkirala wrote:
>>
>>>The following replaces unlabeled_t with network_t for
>>>better characterization of the flow out/in checks in
>>>SELinux, as well as to allow for mls packets to
>>>flow out/in from the network since network_t would allow
>>>the full range of MLS labels, as opposed to the unlabeled init sid
>>>that only allows system-hi.
>>>
>>>Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
>>>---
>>>This is an incremental patch the secid-reconcilation v4 patchset.
>>>
>>>--- net-2.6.sid3/security/selinux/hooks.c 2006-10-01 15:43:12.000000000 -0500
>>>+++ net-2.6/security/selinux/hooks.c 2006-10-03 16:43:21.000000000 -0500
>>>@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
>>> err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
>>> BUG_ON(err);
>>>
>>>- err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
>>>+ err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
>>>+ SECCLASS_PACKET,
>>> PACKET__FLOW_IN, NULL);
>>> if (err)
>>> goto out;
>>>@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
>>> skb->secmark = sksec->sid;
>>> }
>>> }
>>>- err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
>>>+ err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
>>> SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
>>> }
>>> out:
>>
>>Considering the above change, I wonder if it would also make sense to
>>update the secmark to SECINITSID_UNLABELED in the abscence of any
>>external labeling (labeled IPsec or NetLabel)?
>
> Wouldn't that make secmark useless in the non labeled networking case?
>
Sorry, I didn't do a very good job explaining things in my first email
so let me try it again ...
If there is no external labeling, i.e. labeled IPsec or NetLabel, *and*
the secmark is equal to zero/SECSID_NULL I think it might be a good idea
to set the secmark to SECINITSID_NETMSG.
This not affect either local or external labels if they are present, but
if both are not it would give the secmark some meaningful value.
--
paul moore
linux security @ hp
^ permalink raw reply [flat|nested] 10+ messages in thread