From: Paul Moore <paul.moore@hp.com>
To: James Morris <jmorris@namei.org>
Cc: selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org,
netdev@vger.kernel.org
Subject: Re: [RFC PATCH v6 11/16] netlabel: Add functionality to set the security attributes of a packet
Date: Wed, 1 Oct 2008 12:51:12 -0400 [thread overview]
Message-ID: <200810011251.12898.paul.moore@hp.com> (raw)
In-Reply-To: <alpine.LRH.1.10.0810011952100.6732@tundra.namei.org>
On Wednesday 01 October 2008 5:55:49 am James Morris wrote:
> It might be better in the long term to integrate this stuff more
> directly with the core networking.
Agreed. I did it the way I did because I wanted to impact the core
stack as little as possible. I looked at potentially doing the work in
ip_options_compile() but that was going to require a lot of tweaking
and some rather ugly hacks to keep everything contained and off to the
side. Tighter integration with the core stack can always be treated as
an optimization at a later date; I want to see what our IPv6 needs will
be first and I don't have a clear picture of that just yet.
On the plus side, only traffic coming from unconnected sockets is going
to be hit by this and with most stuff using TCP these days I'm hopeful
that the impact to the SELinux folks using labeled networking will be
_relatively_ minimal.
--
paul moore
linux @ hp
next prev parent reply other threads:[~2008-10-01 16:51 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-16 12:55 [RFC PATCH v6 00/16] Labeled networking patches for 2.6.28 Paul Moore
2008-09-16 12:55 ` [RFC PATCH v6 01/16] selinux: Cleanup the NetLabel glue code Paul Moore
2008-10-01 1:35 ` James Morris
2008-10-01 16:34 ` Paul Moore
2008-09-16 12:56 ` [RFC PATCH v6 02/16] selinux: Correctly handle IPv4 packets on IPv6 sockets in all cases Paul Moore
2008-10-01 1:36 ` James Morris
2008-10-01 16:37 ` Paul Moore
2008-09-16 12:56 ` [RFC PATCH v6 03/16] netlabel: Remove unneeded in-kernel API functions Paul Moore
2008-10-01 1:38 ` James Morris
2008-09-16 12:56 ` [RFC PATCH v6 04/16] selinux: Better local/forward check in selinux_ip_postroute() Paul Moore
2008-10-01 1:43 ` James Morris
2008-10-01 16:41 ` Paul Moore
2008-09-16 12:56 ` [RFC PATCH v6 05/16] selinux: Fix a problem in security_netlbl_sid_to_secattr() Paul Moore
2008-09-16 12:56 ` [RFC PATCH v6 06/16] selinux: Fix missing calls to netlbl_skbuff_err() Paul Moore
2008-09-16 12:56 ` [RFC PATCH v6 07/16] smack: " Paul Moore
2008-09-16 12:56 ` [RFC PATCH v6 08/16] netlabel: Replace protocol/NetLabel linking with refrerence counts Paul Moore
2008-10-01 9:01 ` James Morris
2008-09-16 12:56 ` [RFC PATCH v6 09/16] netlabel: Add a generic way to create ordered linked lists of network addrs Paul Moore
2008-10-01 9:09 ` James Morris
2008-09-16 12:56 ` [RFC PATCH v6 10/16] netlabel: Add network address selectors to the NetLabel/LSM domain mapping Paul Moore
2008-10-01 9:14 ` James Morris
2008-09-16 12:57 ` [RFC PATCH v6 11/16] netlabel: Add functionality to set the security attributes of a packet Paul Moore
2008-10-01 9:55 ` James Morris
2008-10-01 16:51 ` Paul Moore [this message]
2008-09-16 12:57 ` [RFC PATCH v6 12/16] selinux: Set socket NetLabel based on connection endpoint Paul Moore
2008-10-01 10:00 ` James Morris
2008-10-01 14:51 ` Joe Nall
2008-10-01 15:09 ` Paul Moore
2008-09-16 12:57 ` [RFC PATCH v6 13/16] selinux: Cache NetLabel secattrs in the socket's security struct Paul Moore
2008-09-16 12:57 ` [RFC PATCH v6 14/16] netlabel: Changes to the NetLabel security attributes to allow LSMs to pass full contexts Paul Moore
2008-09-16 12:57 ` [RFC PATCH v6 15/16] cipso: Add support for native local labeling and fixup mapping names Paul Moore
2008-10-01 10:09 ` James Morris
2008-10-01 17:05 ` Paul Moore
2008-10-01 22:12 ` James Morris
2008-10-02 2:13 ` Paul Moore
2008-09-16 12:57 ` [RFC PATCH v6 16/16] netlabel: Add configuration support for local labeling Paul Moore
2008-10-01 10:13 ` James Morris
2008-10-01 16:54 ` Paul Moore
2008-09-16 13:15 ` [RFC PATCH v6 00/16] Labeled networking patches for 2.6.28 Paul Moore
2008-09-17 4:01 ` Casey Schaufler
2008-10-01 1:34 ` James Morris
2008-10-01 16:24 ` Paul Moore
2008-10-01 22:14 ` James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200810011251.12898.paul.moore@hp.com \
--to=paul.moore@hp.com \
--cc=jmorris@namei.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).