Re: [PATCH 7/7] secid reconciliation-v03: Enforcement for SELinux

[Paul Moore <paul.moore@hp.com>]

Stephen Smalley wrote:
> On Fri, 2006-09-29 at 10:33 -0400, James Morris wrote:
> 
>>On Fri, 29 Sep 2006, Stephen Smalley wrote:
>>
>>
>>>However, since the transition was removed in the flow_out case, it would
>>>be logical to remove it from the flow_in case as well, and that would
>>>have the side benefit of less overhead.
>>
>>How about adding secmark transitions later, if needed, perhaps with an 
>>/selinux config control ?
>>
>>It does keep things simpler for now, in terms of getting this code merged, 
>>deployed into distros and likely certified.
> 
> 
> Fine with me, unless Venkat has an immediate use case for such
> transitions in the flow_in case (but I think this is mostly my fault for
> suggesting transitions a while ago).

Unless I'm confusing something, there still may be a need for transitions
if we want to support both IPsec and NetLabel labeling on the same
connection.
If we don't support transitions and allow both labeling methods on the
same connection we'll need to decide how to handle resolving the two -
maybe use a transition is this one case?

-- 
paul moore
linux security @ hp