netdev - Re: [RFC PATCH v6 11/16] netlabel: Add functionality to set the security attributes of a packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 1 Oct 2008 12:51:12 -0400
From:	Paul Moore <paul.moore@...com>
To:	James Morris <jmorris@...ei.org>
Cc:	selinux@...ho.nsa.gov, linux-security-module@...r.kernel.org,
	netdev@...r.kernel.org
Subject: Re: [RFC PATCH v6 11/16] netlabel: Add functionality to set the security attributes of a packet

On Wednesday 01 October 2008 5:55:49 am James Morris wrote:
> It might be better in the long term to integrate this stuff more
> directly with the core networking.

Agreed.  I did it the way I did because I wanted to impact the core 
stack as little as possible.  I looked at potentially doing the work in 
ip_options_compile() but that was going to require a lot of tweaking 
and some rather ugly hacks to keep everything contained and off to the 
side.  Tighter integration with the core stack can always be treated as 
an optimization at a later date; I want to see what our IPv6 needs will 
be first and I don't have a clear picture of that just yet.

On the plus side, only traffic coming from unconnected sockets is going 
to be hit by this and with most stuff using TCP these days I'm hopeful 
that the impact to the SELinux folks using labeled networking will be 
_relatively_ minimal.

-- 
paul moore
linux @ hp
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html