Re: Denials from newest kernel

[Paul Moore <paul.moore@hp.com>]

Venkat Yekkirala wrote:
>>>>>allow apache_t  httpd_ipsec_t:association { polmatch };
>>>>>
> 
> <snip>
> 
>>The above rule clearly shows a relationship between a domain(socket?)
>>and a SPD entry.  It does not show a relationship between a packet and
>>an association.
> 
> 
> This relationship is implicit in that a packet from apache_t can only
> use an association labeled apache_t. This would be currently shown in the
> SELinux policy itself as:
> 
> allow apache_t apache_t:association { sendto };
> 
> We did talk about moving this "implicit" relationship into the kernel itself
> essentially eliminating the association indirection for SAs.

That might be a good thing to do regardless of the secid work.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.