Re: [PATCH] Labeled IPsec for PostgreSQL/MySQL/SSHd (Re: [PATCH] IPsec SPD default security context)

[Kohei KaiGai <kaigai@ak.jp.nec.com>]

Christopher J. PeBenito wrote:
> On Wed, 2008-02-20 at 14:11 +0900, Kohei KaiGai wrote:
>> Paul Moore wrote:
>>> On Tuesday 19 February 2008 7:59:22 pm Kohei KaiGai wrote:
>>>> Is it acceptable one, if we provide an interface to allow a domain
>>>> to communicate postgresql_t via labeled networking, separated from
>>>> existing permissions for local ports and nodes?
>>>>
>>>> For example:
>>>> -- at postgresql.if
>>>> interface(`postgresql_labeled_connect',`
>>>> 	gen_require(`
>>>> 		type postgresql_t;
>>>> 	')
>>>> 	corenet_tcp_recvfrom_labeled($1,postgresql_t)
>>>> ')
>>>>
>>>> and
>>>> -- at apache.te
>>>> postgresql_labeled_connect(httpd_t)
>>>>
>>>> I think this approach enables to keep independency between modules
>>>> in unlabeled networking cases too.
>>> For what it is worth, it looks like a good idea to me.
>> At first, I implemented this idea for three services (PostgreSQL/MySQL/SSHd).
>>
>> This patch adds the following interfaces:
>> - postgresql_labeled_communicate(domain)
>> - mysql_labeled_communicate(domain)
>> - ssh_labeled_communicate(domain)
>>
>> Chris, is it suitable for refpolicy framework?
> 
> The only issue I have with it would just be the interface naming;
> probably something like mysql_tcp_recvfrom() would be better.

I think the name of "xxxx_tcp_recvfrom()" is not obvious whether it means
permissions related to labeled networking, or not.

What do you think the following ideas?
 - something_labeled_recvfrom(domain)
      or
 - something_labeled_tcp_recvfrom(domain)

Thanks,
--
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.