Re: [PATCH RFC 0/2] stricter MLS policy constraints

[Paul Moore <paul.moore@hp.com>]

Klaus Weidner wrote:
> The patches are very lightly tested (the policy builds, and permits
> unlabeled ssh login in enforcing mode) -- can the people doing labeled
> networking tests please test it?

I did a quick test using the refpolicy from SVN and your patches; the good news
is that simple tests using netcat worked as expected and there did not appear to
be any regressions.

The bad news is that I realized we never added NetLabel receive permissions to
any of the application domains (try to telnet into a machine with NetLabel);
only the user domains have the NetLabel receive permissions.  As a result I
wasn't able to try any more elaborate tests without fixing the policy.  It will
probably take a little while to get a patch out to address this as there are a
lot of domains which need to be changed; that said I'm probably about a third of
the way through at this point.

In case anyone is interested, the policy changes boil down to the following:

 ifdef(`enable_mls',`
        corenet_tcp_recv_netlabel(app_domain_t)
        corenet_udp_recv_netlabel(app_domain_t)
 ')

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.