Re: Speaking of networking...

[Joshua Brindle <method@manicmethod.com>]

James Morris wrote:
> On Wed, 27 Feb 2008, Stephen Smalley wrote:
>
>   
>> On Thu, 2008-02-28 at 01:01 +1100, James Morris wrote:
>>     
>>> Any further thoughts on how to push the secmark integration forward?
>>>
>>> The secmark table patch should allow MAC rules to be administered 
>>> independently, and I know there has been some demand for the new (well, 
>>> now not so new) networking controls.
>>>       
>> Has the secmark table patch gone upstream yet?
>>     
>
> Nope.  I think we need to know that it's going to be useful first.
>   

Thats something of a chicken/egg problem. We need a separate table so 
that we can peacefully co-exist with user rules before we can deploy it 
widely (eg., to fedora users) to determine the viability of policy 
driven secmark labeling.

On a related note CLIP has a rebuilt iptables that they should be 
including in their next release because users of CLIP are very 
interested in secmark labeling as well. This obviously will be in the 
mangle table since they are using a RHEL5 kernel but it will still be 
available.




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.