* iodine and SE Linux
@ 2011-01-09 5:56 Russell Coker
2011-01-12 20:12 ` Christopher J. PeBenito
0 siblings, 1 reply; 3+ messages in thread
From: Russell Coker @ 2011-01-09 5:56 UTC (permalink / raw)
To: SE-Linux
I notice that iodine (IP over DNS tunnel daemon) has sample SE Linux policy
and a SE Linux patch to the source code.
The way it works is that you give iodine a -z parameter with the context that
you want and it then calls setcon() to get it.
What I am thinking of doing is writing policy for iodine, icmptx, and any
other daemon that operates in a similar manner that has an automatic domain
transition and no setcon(). I am thinking of making this tunnel_t.
What do you think?
--
russell@coker.com.au
http://etbe.coker.com.au/ My Main Blog
http://doc.coker.com.au/ My Documents Blog
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: iodine and SE Linux
2011-01-09 5:56 iodine and SE Linux Russell Coker
@ 2011-01-12 20:12 ` Christopher J. PeBenito
2011-01-12 20:33 ` hmarti2
0 siblings, 1 reply; 3+ messages in thread
From: Christopher J. PeBenito @ 2011-01-12 20:12 UTC (permalink / raw)
To: russell; +Cc: SE-Linux
On 1/9/2011 12:56 AM, Russell Coker wrote:
> I notice that iodine (IP over DNS tunnel daemon) has sample SE Linux policy
> and a SE Linux patch to the source code.
>
> The way it works is that you give iodine a -z parameter with the context that
> you want and it then calls setcon() to get it.
>
> What I am thinking of doing is writing policy for iodine, icmptx, and any
> other daemon that operates in a similar manner that has an automatic domain
> transition and no setcon(). I am thinking of making this tunnel_t.
>
> What do you think?
I'm not familiar with these tunnel services; does it make sense to adapt
the existing stunnel policy? Or if we went to a tunnel_t generic
service, would it be possible to get stunnel over to it?
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: iodine and SE Linux
2011-01-12 20:12 ` Christopher J. PeBenito
@ 2011-01-12 20:33 ` hmarti2
0 siblings, 0 replies; 3+ messages in thread
From: hmarti2 @ 2011-01-12 20:33 UTC (permalink / raw)
To: Christopher J. PeBenito, owner-selinux, russell; +Cc: SE-Linux
Chris,
Perhaps a generic one may be best, as some of the custom protocols desired to be tunneled will not make it into a 'stunnel' discussion or forum. At least not in some places where we use the product.
Best, Hal
Sent via BlackBerry by AT&T
-----Original Message-----
From: "Christopher J. PeBenito" <cpebenito@tresys.com>
Sender: owner-selinux@tycho.nsa.gov
Date: Wed, 12 Jan 2011 15:12:46
To: <russell@coker.com.au>
Cc: SE-Linux<selinux@tycho.nsa.gov>
Subject: Re: iodine and SE Linux
On 1/9/2011 12:56 AM, Russell Coker wrote:
> I notice that iodine (IP over DNS tunnel daemon) has sample SE Linux policy
> and a SE Linux patch to the source code.
>
> The way it works is that you give iodine a -z parameter with the context that
> you want and it then calls setcon() to get it.
>
> What I am thinking of doing is writing policy for iodine, icmptx, and any
> other daemon that operates in a similar manner that has an automatic domain
> transition and no setcon(). I am thinking of making this tunnel_t.
>
> What do you think?
I'm not familiar with these tunnel services; does it make sense to adapt
the existing stunnel policy? Or if we went to a tunnel_t generic
service, would it be possible to get stunnel over to it?
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-01-12 20:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-01-09 5:56 iodine and SE Linux Russell Coker
2011-01-12 20:12 ` Christopher J. PeBenito
2011-01-12 20:33 ` hmarti2
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.