From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: New audit record types for static network labels Date: Tue, 31 Jul 2007 15:37:14 -0400 Message-ID: <200707311537.14940.paul.moore@hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l6VJeJhA024971 for ; Tue, 31 Jul 2007 15:40:19 -0400 Received: from atlrel9.hp.com (atlrel9.hp.com [156.153.255.214]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l6VJeCwp023393 for ; Tue, 31 Jul 2007 15:40:12 -0400 Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: selinux@tycho.nsa.gov List-Id: linux-audit@redhat.com I am currently working on a series of patches to add support for static external network labels to NetLabel/SELinux. The idea is that a user could define a physical interface, IP address, address mask, and context which would be applied as an external label to the packet when an explicit label was not present. This is similar to other trusted OSs which allow administrators to assign labels to single level, unlabeled networks. For those of you following the SELinux list it was discussed a month or two ago. This is relevant to the audit subsystem because adding/removing these address/context entries should most likely be audited for the same reasons we audit other NetLabel or XFRM labeling related configuration changes. To accomplish this I would like to suggest the addition of the following record types, comments? #define AUDIT_MAC_UNLBL_STATICADD 14XX /* NetLabel: add a static label */ #define AUDIT_MAC_UNLBL_STATICDEL 14XX /* NetLabel: del a static label */ -- paul moore linux security @ hp