From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [PATCH 7/7] secid reconciliation-v03: Enforcement for SELinux Date: Fri, 29 Sep 2006 13:32:32 -0400 (EDT) Message-ID: References: <36282A1733C57546BE392885C0618592015CF2BE@chaos.tcs.tcs-sec.com> <451D4A51.4000603@hp.com> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: Venkat Yekkirala , Stephen Smalley , Joshua Brindle , netdev@vger.kernel.org, selinux@tycho.nsa.gov, kmacmillan@mentalrootkit.com Return-path: Received: from mail7.sea5.speakeasy.net ([69.17.117.9]:57750 "EHLO mail7.sea5.speakeasy.net") by vger.kernel.org with ESMTP id S1751135AbWI2Rcf (ORCPT ); Fri, 29 Sep 2006 13:32:35 -0400 To: Paul Moore In-Reply-To: Sender: netdev-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Fri, 29 Sep 2006, James Morris wrote: > On Fri, 29 Sep 2006, Paul Moore wrote: > > > > It seems more of a pain to actually > > > prevent their use at the same time and/or explain strange/unnatural > > > behavior. > > > > Agreed, the solution that we agreed upon is much easier to implement and > > explain than a lot of the alternatives. > > Ok, can you please explain it further? > > i.e. show me what the policy looks like, exactly what the user is trying > to achieve, and explain what happens to each packet exactly in terms of > labeling on the input and output paths. Also, why can't this be done just with xfrm labeling? CIPSO is not there to provide a mechanism for separating the label of the connection from the label of the data, it's only there to provide interop with legacy systems. If you need to have two labels for a packet (the object and the domain), then this needs to be supported directly by xfrm labeling. - James -- James Morris