Re: secmark integration

[Joshua Brindle <method@manicmethod.com>]

James Morris wrote:
> On Mon, 2 Apr 2007, Eric Paris wrote:
>
>   
>> Seems to me that port number is the only thing we can label based on for
>> everyone out of the box.  Any more complex labeling scheme is going to
>> require network specific information, right?
>>     
>
> For gateways & externally facing systems, we could use types for the 
> interfaces, e.g. external_netif, internal_netif and have a loadable module 
> or something which differentiates between internal and external traffic.
>
>   
Unfortunately it isn't nearly this easy. If your security goal was just 
to differentiate internal and external traffic it would work fine but 
you'd be losing all granularity of port based access control. To do this 
with the refpolicy model of labeling based on service ports you'd have 
to replicate the entire corenetwork module with internal and external 
types and then fix all the service domains to be able to use the 
appropriate ones. I just don't think this scales.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.