Re: SELinux Networking Enhancements

[Paul Moore <paul.moore@hp.com>]

James Morris wrote:
> On Wed, 1 Nov 2006, Paul Moore wrote:
> 
>>>Ok, so, there'd be an iptables match which looked up the security context 
>>>on the SA the packet arrives/departs on?  Sounds like it could work.  
>>>Perhaps call it xfrmlabel ?
>>
>>What we name it probably isn't that important, but I sorta prefer Venkat's
>>original suggestion of secfilter (or secidfilter, or <generic security
>>token>filter) since it sounds like this new component would be strictly for
>>filtering and not labeling.
> 
> Well, it's matching labels on xfrms.  The filtering concept is implicit in 
> it being an iptables match, and secid/sec is vague.

I got the impression that Venkat was intending this to work for external labels
(both XFRM and NetLabel) as well as internal labels (SECMARK).  I would be a lot
happier if the name didn't limit it to just XFRM labeling.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.