Re: [redhat-lspp] labeled ipsec auditing

[Joy Latten <latten@austin.ibm.com>]

On Wed, 2006-10-11 at 08:38 -0500, Serge E. Hallyn wrote:
> Quoting Joy Latten (latten@austin.ibm.com):
> > On Mon, 2006-10-09 at 14:30 -0500, Klaus Weidner wrote:
> > > On Mon, Oct 09, 2006 at 03:15:09PM -0400, Paul Moore wrote:
> > > > Going back to Joy's original mail I think it was the establishing or deleting of
> > > > an SA with SELinux context that we were concerned about (at least that is what I
> > > > was concerned about) as that could generate quite a bit of traffic.  Based on
> > > > your comments above it looks like that is something we need to do.
> > > 
> > > Here's what Joy wrote: 
> > > 
> > > > I am auditing when an ipsec policy is added and removed from the
> > > > Security Policy Database. Should I also add audit when an SA is
> > > > added and removed? 
> > > 
> > > If I understand it correctly, SAs can also be added and removed manually,
> > > and unless we forbid that admins do that, it would need to be audited.
> > > 
> > 
> > Then do I only want to audit when an SA or SPD is manually added or
> > deleted? Or just audit them regardless?
> 
> Hi Joy,
> 
> you didn't quote the part of Klaus' email which I was hoping you'd
> answer:
> 
> > If the SPD completely determines the rules for ipsec related to MLS, it
> > would not be necessary to audit the individual additions and deletions,
> > but I'm not convinced that's the case. Does modifying the SPD
> > automatically tear down any currently active SAs that do not match the
> > updated policy?

Sorry about that. :-) Ok, I used Eric's kernel and determined the
following. First, it doesn't seem the SPD completely determines the
rules for ipsec related to MLS. I set my spd to have "s2", and the SAs
created by racoon all had "s0-s15:c0.c1023". In fact they get this no
matter what. This does not seem correct behavior to me. I looked at the
code and it seems we are tacking on the mls label of the flow's secid to
our SA's security context. But I could not find where the flow's secid
gets set on output anywhere in xfrm code. I do not understand this.

Ok, next, I removed the policy in my spd, but SAs created by racoon
stayed around. I had to manually flush them to remove them. 

Joy