Re: [RFC 0/5] Static/fallback external labels for NetLabel

[Joshua Brindle <method@manicmethod.com>]

Joe Nall wrote:
>
> On Aug 28, 2007, at 1:51 PM, Paul Moore wrote:
>
>> On Tuesday, August 28 2007 12:18:05 pm Joe Nall wrote:
>>>
>>> Will interface aliases (eth0:1) be able to take on different labels 
>>> from
>>> their base interface?
>>
>> Not sure, it all depends on if an interface alias ends up creating a 
>> separate
>> net_device struct in the kernel, I don't have the answer to this off 
>> the top
>> of my head.  What is your preference?
>
> That interface aliases be independently labeled.

I completely agree with Stephen here. Accessing the same physical piece 
of hardware (on the same wire) through a different 'name' provides 
basically nothing. Most people I've talked to aren't even comfortable 
using nics that share the same chips on board (eg., dual nics on the 
motherboard). Ofcourse those people are somehow mislead into believing 
that there is any security gain there since all the network data ends up 
in the same place eventually.

OTOH using a single nic with multiple ipsec associations (with different 
keys ofcourse) could provide a benefit, depending on what your 
requirements are.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.