Re: attributes on the other end of a network connection

[Kodungallur Varma <ramgwu@gmail.com>]

Hi Stephen and all,

         is there any way to determine if a particular operation is
permitted given a security identifier (security_context_t)? basically
I want a function or a way to determine if any process/user in the
domain returned by the getpeercon() is allowed to do an operation, say
socket connect for example.

thanx..
Ram

On 4/20/05, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On Tue, 2005-04-19 at 22:09 -0400, Kodungallur Varma wrote:
> > Hi all,
> >
> >         I have a basic client and a server program. my server has the
> > capability to setcon() to a new domain, the client domain precisely.
> > my server needs to find the domain and user name of the client user(my
> > client tries to get a tcp connection first). I heard there is a
> > function which gives the context and attributes of the other end,
> > given the attributes got at the servers end and vice-versa. I dont
> > know where exactly to look for that function capability, but I am
> > starting in the libselinux library. for security reasons, my client
> > also needs to be able to execute this function to get the attributes
> > of the server, just to know that it is connecting to the right server.
> > if anyone knows about any such function, please pass on to me. thanx a lot..
> 
> That requires some form of labeled networking support, which doesn't
> exist in the mainline SELinux presently.  Older SELinux had an
> experimental labeled networking implementation (Selopt) by James Morris
> based on CIPSO/FIPS188 options, but the necessary security hooks and
> fields weren't accepted into mainline Linux.  Trent Jaeger of IBM has
> implemented implicit packet labeling based on IPSEC SA, and I believe
> that there is work ongoing to provide such an interface using that
> support, but that hasn't been merged yet.  getpeercon(3) is the existing
> interface, but only works for Unix domain stream sockets presently, as
> James noted.
> 
> --
> Stephen Smalley <sds@tycho.nsa.gov>
> National Security Agency
> 
>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.