Re: secmark integration

[Daniel J Walsh <dwalsh@redhat.com>]

James Morris wrote:
> On Fri, 30 Mar 2007, Eric Paris wrote:
>
>   
>>> Is this really needed as long as the distro provides a way to customize
>>> the iptables rules?
>>>       
>> It's not just that.  The reason a new table was proposed was because
>> people may want to iptables -F and flush their rules.  If the secmark
>> stuff is on the main tables (filter and nat) that people use it will get
>> blown away and there will be no automation of a boolean setting you talk
>> about later.
>>     
>
> I think there's also a good case for a separate table on the basis that 
> the rules are part of a separate administrative realm (e.g. MAC, rather 
> than DAC) and should be maintained separately.  We could also look at 
> adding an LSM hook for rules being manipulated in this table (perhaps 
> called 'security' to be more general).
>
> Note that there may be tools which parse /proc/net/ip_tables_names when 
> flushing (which the LSM hook would possibly help with in terms of stopping 
> MAC policy from being modified without the correct authorization).
>
> It still may be difficult to sell upstream, so we'd need more feedback 
> from the distro folk possibly after some experimentation.
>
>
> - James
>   

I like karl suggestion.  service iptables stop , flips boolean that says 
all domains support unlabeled_t:packet.  service iptables start turns 
that off.

Currently there is a boolean in Rawhide allow_unlabeled_packets.

tunable_policy(`allow_unlabeled_packets',`
        kernel_sendrecv_unlabeled_association(domain)
        corenet_sendrecv_unlabeled_packets(domain)
')
These lines endup generating these rules
        allow domain unlabeled_t:packet { send recv };
        allow domain $1 unlabeled_t:association { sendto recvfrom };

This boolean defaults to true.


I think as soon as FC7 ships we can start experimenting in Rawhide and 
build a couple of scripts/modules that people could use to take 
advantage of secmark.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.