linux-kernel - Re: SMACK netfilter smacklabel socket match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Sep 2008 14:35:12 +0200
From:	Tilman Baumann <tilman.baumann@...lax.com>
To:	Paul Moore <paul.moore@...com>
CC:	Linux-Kernel <linux-kernel@...r.kernel.org>,
	Casey Schaufler <casey@...aufler-ca.com>,
	linux-security-module@...r.kernel.org
Subject: Re: SMACK netfilter smacklabel socket match

Paul Moore wrote:

> [NOTE: you may notice the above code changing slightly in future 
> kernels, it turns out that skb->sk == NULL is not a true indicator of a 
> non-local sender, see my labeled networking patches for 2.6.28 or 
> linux-next for the revised approach]

Can you give me a pointer where to look?

Will this mean that skb->sk may be invalid or that it will point to a a 
context based on the network label the packet has?
In the later case, being able to match remote labels in my match would 
just give added benefit. (Though a netlabel (CIPSO) match would probably 
be more sane than a smack specific match.)
One would just have more choices where to put a rule like this. Like in 
the FORWARD chain.
If non local packets are of no interest, one could put the rule in the 
right chain.

But i think i just misunderstood you here. Since having a socket for non 
local packets is probably not what you meant.

Regards
  Tilman
-- 
Tilman Baumann
Software Developer
Collax GmbH . Boetzinger Strasse 60 . 79111 Freiburg . Germany

p: +49 (0) 89-990157-0
f: +49 (0) 89-990157-11

Geschaeftsfuehrer: William K. Hite / Boris Nalbach
AG Muenchen HRB 158898, Ust.-IdNr: DE 814464942
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/