New audit record types for static network labels

New audit record types for static network labels

[Paul Moore]

I am currently working on a series of patches to add support for static 
external network labels to NetLabel/SELinux.  The idea is that a user could 
define a physical interface, IP address, address mask, and context which 
would be applied as an external label to the packet when an explicit label 
was not present.  This is similar to other trusted OSs which allow 
administrators to assign labels to single level, unlabeled networks.  For 
those of you following the SELinux list it was discussed a month or two ago.

This is relevant to the audit subsystem because adding/removing these 
address/context entries should most likely be audited for the same reasons we 
audit other NetLabel or XFRM labeling related configuration changes.  To 
accomplish this I would like to suggest the addition of the following record 
types, comments?

#define AUDIT_MAC_UNLBL_STATICADD 14XX  /* NetLabel: add a static label */
#define AUDIT_MAC_UNLBL_STATICDEL 14XX  /* NetLabel: del a static label */

-- 
paul moore
linux security @ hp