From: Paul Moore <paul.moore@hp.com>
To: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Cc: James Morris <jmorris@namei.org>,
netdev@vger.kernel.org, selinux@tycho.nsa.gov,
Stephen Smalley <sds@tycho.nsa.gov>,
Chad Hanson <chanson@TrustedCS.com>,
"David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH 0/3] secid reconciliation-v01: Repost patchset with up dates
Date: Wed, 30 Aug 2006 16:21:46 -0400 [thread overview]
Message-ID: <44F5F35A.7000904@hp.com> (raw)
In-Reply-To: <Pine.LNX.4.64.0608251025120.23473@d.namei>
James Morris wrote:
> On Fri, 25 Aug 2006, Venkat Yekkirala wrote:
>>>I like these changes, but wondering why you haven't supplied
>>>code for the
>>>outbound case ?
>>
>>The code for the outbound is still in the works. I hope to have it
>>out in a week or so.
>
> Ok, I guess we should wait until then before incorporating the patches
> (also, for Paul Moore to return and comment re. CIPSO).
My main concern with these patches is that moving the NetLabel check out
of selinux_socket_sock_rcv_skb() and into selinux_skb_policy_check() (as
it is currently written) would force us to compare a packet's NetLabel
with either the IPsec label or the secmark label and not the socket's
label. The ability to make access decisions based on the process
consuming the data and the data itself it one of the nicer qualities of
NetLabel in my opinion.
Like James, I'd also like to see the outbound side too.
--
paul moore
linux security @ hp
next prev parent reply other threads:[~2006-08-30 20:21 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-08-25 13:30 [PATCH 0/3] secid reconciliation-v01: Repost patchset with up dates Venkat Yekkirala
2006-08-25 14:26 ` James Morris
2006-08-30 20:21 ` Paul Moore [this message]
-- strict thread matches above, loose matches on Subject: below --
2006-08-31 14:08 Venkat Yekkirala
2006-08-31 14:45 ` Paul Moore
2006-08-31 15:13 Venkat Yekkirala
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=44F5F35A.7000904@hp.com \
--to=paul.moore@hp.com \
--cc=chanson@TrustedCS.com \
--cc=davem@davemloft.net \
--cc=jmorris@namei.org \
--cc=netdev@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
--cc=vyekkirala@TrustedCS.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).