| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 7 Oct 2008 01:05:51 +0200 From: "Ahmed S. Darwish" <darwish.07@...il.com> To: "Tilman Baumann" <tilman.baumann@...lax.com> Cc: "Casey Schaufler" <casey@...aufler-ca.com>, Linux-Kernel <linux-kernel@...r.kernel.org>, linux-security-module@...r.kernel.org Subject: Re: SMACK netfilter smacklabel socket match Hi Tilman, On Mon, Oct 6, 2008 at 2:57 PM, Tilman Baumann <tilman.baumann@...lax.com> wrote: > If I set /smack/nltype to 'unlabeled' I have effectively shut off the > network. ... > This might work well in trusted networks. > But Internet is untrusted and needs to work too. At least in the most real > world scenarios. :) > > If i set /smack/nltype to 'unlabled' i don't even get SYN packets out. > (operation not permitted) > > That's probably a bug, but I think the "fix" is to disable the ability to > set the nltype to anything other than CIPSO at least for the time being. Check this patch: http://article.gmane.org/gmane.linux.network/95294/match= As far as I can remember, it does exactly what you're asking for. There have been some arguments against it, but at least you can get the idea and _try_ to discuss/enhance it further. Regards -- Ahmed S. Darwish Homepage: http://darwish.07.googlepages.com Blog: http://darwish-07.blogspot.com -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists