linux-kernel - Re: [PATCH RFC] selinux: support wildcard network interface names

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8fdd1a7b0714532aa2498c52f0461386@paul-moore.com>
Date: Wed, 26 Feb 2025 13:54:07 -0500
From: Paul Moore <paul@...l-moore.com>
To: Christian Göttsche <cgoettsche@...tendoof.de>
Cc: Christian Göttsche <cgzones@...glemail.com>, Stephen Smalley <stephen.smalley.work@...il.com>, Ondrej Mosnacek <omosnace@...hat.com>, Thiébaud Weksteen <tweek@...gle.com>, Bram Bonné <brambonne@...gle.com>, Casey Schaufler <casey@...aufler-ca.com>, GUO Zihua <guozihua@...wei.com>, Canfeng Guo <guocanfeng@...ontech.com>, selinux@...r.kernel.org, linux-kernel@...r.kernel.org, John Johansen <john.johansen@...onical.com>
Subject: Re: [PATCH RFC] selinux: support wildcard network interface names

On Dec 17, 2024 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@...tendoof.de> wrote:
> 
> Add support for wildcard matching of network interface names.  This is
> useful for auto-generated interfaces, for example podman creates network
> interfaces for containers with the naming scheme podman0, podman1,
> podman2, ...
> 
> Since the wildcard characters '?' and '*' should be very uncommon in
> network interface names, and thus if netifcon definitions, avoid
> introducing a new policy version or capability.
> 
> Netifcon definitions are compared against in the order given by the
> policy, so userspace tools should sort them in a reasonable order.
> 
> Signed-off-by: Christian Göttsche <cgzones@...glemail.com>
> ---
>  security/selinux/include/security.h | 2 +-
>  security/selinux/ss/services.c      | 5 +++--
>  2 files changed, 4 insertions(+), 3 deletions(-)

My apologies on the delay in responding, overall I think is a nice
improvement, but I would feel a lot better if we wrapped this with a
policy capability so that users/admins that did run into a problem
would have a way to work around this using policy.

--
paul-moore.com