netdev - Re: [PATCH v4 00/19] CALIPSO Implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 21 Jun 2016 15:33:39 -0400
From:	Paul Moore <paul@...l-moore.com>
To:	Huw Davies <huw@...eweavers.com>,
	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org, linux-security-module@...r.kernel.org,
	selinux@...ho.nsa.gov
Subject: Re: [PATCH v4 00/19] CALIPSO Implementation

On Tue, Jun 21, 2016 at 5:55 AM, Huw Davies <huw@...eweavers.com> wrote:
> On Tue, Jun 21, 2016 at 05:39:28AM -0400, David Miller wrote:
>> From: Huw Davies <huw@...eweavers.com>
>> Date: Mon, 20 Jun 2016 14:36:40 +0100
>>
>> > This patch series implements RFC 5570 - Common Architecture Label IPv6
>> > Security Option (CALIPSO).  Its goal is to set MLS sensitivity labels
>> > on IPv6 packets using a hop-by-hop option.  CALIPSO is very similar to
>> > its IPv4 cousin CIPSO and much of this series is based on that code.
>>
>> What tree do you expect to integrate this?
>
> My understanding is that Paul Moore is happy to take them
> in via the SELinux tree.  However, these patches do touch
> some core networking code, such as the IPv6 option handling
> code (in a similar manner to the way CIPSO touched the IPv4
> option code), so if you have any comments on those aspects
> that would be good to hear.

Huw is correct.  I haven't yet gone through this latest patchset,
although I've reviewed the previous versions and provided feedback;
the v3 revision looked pretty good to me and I'm assuming I won't find
any showstoppers in the v4 revision.

I'm happy to push this upstream via the SELinux tree, but only with an
implicit ACK from DaveM since it does touch of the core stack (in ways
comparable to what we did for CIPSO and IPv4).  If DaveM would prefer
to merge these patches via the netdev tree, that's fine too, I'll take
a closer look later this week and send my ACKs.

DaveM, let me know how you want to proceed with this patchset.

-- 
paul moore
www.paul-moore.com