Re: Labeled Networking Requirements and Design (formerly RE: [PATCH 01/06] MLSXFRM: Granular IPSec associations for use in MLS environments)

[Venkat Yekkirala <vyekkirala@trustedcs.com>]

Venkat Yekkirala wrote:
>> Keeping in mind (R1a), I wonder if it makes more sense for (OTBND1a) 
>> to take the label of the process/domain which sends the data to the 
>> socket? After all, the process/domain is the "origin" of the data.
> 
> Right. This is what "ends up" happening in the non-privileged case. In the
> privileged multi-level process case, the label of the data has in fact been
> established at the socket creation time itself, and here we are trusting 
> the
> privileged multi-level process with sending data out on the right socket 
> with
> the knowledge that the data would be labeled with the label of the socket.
> 
>>  This seems to be particularly important in the case of 
>> fork()-then-exec() where you could have a socket created at a 
>> different context from the domain currently writing to it.
> 
> It would also help to remember that there are additional process-to-socket
> controls (sendmsg, recvmsg) already in place in SELinux.
> 
In summary it's a matter of architecture.