* [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro
@ 2006-10-09 12:21 Venkat Yekkirala
2006-10-09 12:40 ` Joshua Brindle
2006-10-09 14:28 ` Paul Moore
0 siblings, 2 replies; 6+ messages in thread
From: Venkat Yekkirala @ 2006-10-09 12:21 UTC (permalink / raw)
To: selinux; +Cc: redhat-lspp, jmorris, sds, paul.moore, eparis, jbrindle
This patchset is relative to davem's net-2.6 git tree as of a few weeks back,
and is an incremental fix to the secid-reconciliation patch series plus
the ipsec leak patches.
This patchset includes the fix sent out this past Friday night.
This patchset is more immediately intended for the kernels undergoing
LSPP certification, but needs to be reviewed for very-near-future
upstreaming into 2.6.19.
Paul, if you could respin your patchset relative to this one I would
appreciate it. While doing so, can you look for NetLabel only when
there's no xfrm label on a packet, since we now know that using both
is redundant? This way we don't have to worry about NetLabel code
bugs/side effects when someone is using just xfrm. Thanks.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro
2006-10-09 12:21 [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro Venkat Yekkirala
@ 2006-10-09 12:40 ` Joshua Brindle
2006-10-09 14:28 ` Paul Moore
1 sibling, 0 replies; 6+ messages in thread
From: Joshua Brindle @ 2006-10-09 12:40 UTC (permalink / raw)
To: Venkat Yekkirala; +Cc: selinux, redhat-lspp, jmorris, sds, paul.moore, eparis
On Mon, 2006-10-09 at 07:21 -0500, Venkat Yekkirala wrote:
> This patchset is relative to davem's net-2.6 git tree as of a few weeks back,
> and is an incremental fix to the secid-reconciliation patch series plus
> the ipsec leak patches.
>
Do you have a git tree with everything you have so far? Some of your
patches won't apply to the net-2.6 I have. Perhaps James could put a
branch in his selinux-2.6?
> This patchset includes the fix sent out this past Friday night.
>
> This patchset is more immediately intended for the kernels undergoing
> LSPP certification, but needs to be reviewed for very-near-future
> upstreaming into 2.6.19.
>
> Paul, if you could respin your patchset relative to this one I would
> appreciate it. While doing so, can you look for NetLabel only when
> there's no xfrm label on a packet, since we now know that using both
> is redundant? This way we don't have to worry about NetLabel code
> bugs/side effects when someone is using just xfrm. Thanks.
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro
2006-10-09 12:21 [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro Venkat Yekkirala
2006-10-09 12:40 ` Joshua Brindle
@ 2006-10-09 14:28 ` Paul Moore
2006-10-09 14:33 ` James Morris
2006-10-09 16:27 ` Paul Moore
1 sibling, 2 replies; 6+ messages in thread
From: Paul Moore @ 2006-10-09 14:28 UTC (permalink / raw)
To: Venkat Yekkirala; +Cc: selinux, redhat-lspp, jmorris, sds, eparis, jbrindle
Venkat Yekkirala wrote:
> This patchset is relative to davem's net-2.6 git tree as of a few weeks back,
> and is an incremental fix to the secid-reconciliation patch series plus
> the ipsec leak patches.
>
> This patchset includes the fix sent out this past Friday night.
>
> This patchset is more immediately intended for the kernels undergoing
> LSPP certification, but needs to be reviewed for very-near-future
> upstreaming into 2.6.19.
>From what I understand the merge window for 2.6.19 is closed, it closed last
week with the release of 2.6.19-rc1. While 2.6.19 is still open for bugfixes,
its not entirely clear to me this would qualify. Perhaps James could give us
his opinion.
Regardless, there is always 2.6.20 and of course RHEL5 although I wonder at this
point if that ship has passed too.
> Paul, if you could respin your patchset relative to this one I would
> appreciate it. While doing so, can you look for NetLabel only when
> there's no xfrm label on a packet, since we now know that using both
> is redundant? This way we don't have to worry about NetLabel code
> bugs/side effects when someone is using just xfrm. Thanks.
As far as I can tell there are no problems with the latest NetLabel/secid patch
when layered on top of the secid patches. There was a lot of testing and debate
on this last Friday but it turned out to be a problem with the secid patch not
clearing the secmark on exit as well as some confusion around policy and
multicast traffic. All of the NetLabel bugs from the past month or two have
only occurred on communication channels when NetLabel was in use - there was
some thought that the recent Bluetooth bug was NetLabel related but it wasn't,
it was a fault with the MLSXFRM patchset.
If there is some issue I'm not aware of send me some mail or give me a call
(603-641-0536) and we can work it out.
--
paul moore
linux security @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro
2006-10-09 14:28 ` Paul Moore
@ 2006-10-09 14:33 ` James Morris
2006-10-09 16:27 ` Paul Moore
1 sibling, 0 replies; 6+ messages in thread
From: James Morris @ 2006-10-09 14:33 UTC (permalink / raw)
To: Paul Moore; +Cc: Venkat Yekkirala, selinux, redhat-lspp, sds, eparis, jbrindle
On Mon, 9 Oct 2006, Paul Moore wrote:
> Venkat Yekkirala wrote:
> > This patchset is relative to davem's net-2.6 git tree as of a few weeks back,
> > and is an incremental fix to the secid-reconciliation patch series plus
> > the ipsec leak patches.
> >
> > This patchset includes the fix sent out this past Friday night.
> >
> > This patchset is more immediately intended for the kernels undergoing
> > LSPP certification, but needs to be reviewed for very-near-future
> > upstreaming into 2.6.19.
>
> >From what I understand the merge window for 2.6.19 is closed, it closed last
> week with the release of 2.6.19-rc1. While 2.6.19 is still open for bugfixes,
> its not entirely clear to me this would qualify. Perhaps James could give us
> his opinion.
>
> Regardless, there is always 2.6.20 and of course RHEL5 although I wonder at this
> point if that ship has passed too.
Yep, any new features now would go into a 2.6.20 queue.
- James
--
James Morris
<jmorris@namei.org>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro
2006-10-09 14:28 ` Paul Moore
2006-10-09 14:33 ` James Morris
@ 2006-10-09 16:27 ` Paul Moore
1 sibling, 0 replies; 6+ messages in thread
From: Paul Moore @ 2006-10-09 16:27 UTC (permalink / raw)
To: Venkat Yekkirala; +Cc: selinux, redhat-lspp, jmorris, sds, eparis, jbrindle
Paul Moore wrote:
> Venkat Yekkirala wrote:
>>Paul, if you could respin your patchset relative to this one I would
>>appreciate it. While doing so, can you look for NetLabel only when
>>there's no xfrm label on a packet, since we now know that using both
>>is redundant? This way we don't have to worry about NetLabel code
>>bugs/side effects when someone is using just xfrm. Thanks.
>
> As far as I can tell there are no problems with the latest NetLabel/secid patch
> when layered on top of the secid patches. There was a lot of testing and debate
> on this last Friday but it turned out to be a problem with the secid patch not
> clearing the secmark on exit as well as some confusion around policy and
> multicast traffic. All of the NetLabel bugs from the past month or two have
> only occurred on communication channels when NetLabel was in use - there was
> some thought that the recent Bluetooth bug was NetLabel related but it wasn't,
> it was a fault with the MLSXFRM patchset.
>
> If there is some issue I'm not aware of send me some mail or give me a call
> (XXX-XXX-XXXX) and we can work it out.
Please disregard the phone number I send out earlier, it was the wrong number -
if you need to get ahold of me please call me at 603-884-5056.
--
paul moore
linux security @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro
@ 2006-10-09 13:56 Venkat Yekkirala
0 siblings, 0 replies; 6+ messages in thread
From: Venkat Yekkirala @ 2006-10-09 13:56 UTC (permalink / raw)
To: Joshua Brindle, Venkat Yekkirala
Cc: selinux, redhat-lspp, jmorris, sds, paul.moore, eparis
> Do you have a git tree with everything you have so far? Some of your
> patches won't apply to the net-2.6 I have. Perhaps James could put a
> branch in his selinux-2.6?
I unfortunately don't have a git tree accessible from the outside. And
I haven't updated my git tree since Eric Paris was already having to
think about updating RHEL5 networking to accommodate the secid work that was
posted recently. I was really hoping for Eric/Steve to apply this patch to
the lspp tree and spin a new kernel.
But I will try to get a cumulative patch out today that will apply to
the latest net-2.6.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2006-10-09 16:27 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-10-09 12:21 [PATCH 0/1] selinux: secid reconciliation fixes V01: Intro Venkat Yekkirala
2006-10-09 12:40 ` Joshua Brindle
2006-10-09 14:28 ` Paul Moore
2006-10-09 14:33 ` James Morris
2006-10-09 16:27 ` Paul Moore
-- strict thread matches above, loose matches on Subject: below --
2006-10-09 13:56 Venkat Yekkirala
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.