secid reconciliation-v02: Repost patchset with updates
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest7 patches 11 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/7 | secid reconciliation-v02security/ security/ | +2 | 2 replies | |
| 2/7 | secid reconciliation-v02: Add LSM hooksinclude/ security/ | +6 | 1 reply | |
| 3/7 | secid reconciliation-v02: Invoke LSM hook for inbound trafficinclude/ | +0 | 1 reply | |
| 4/7 | secid reconciliation-v02: Invoke LSM hook for outbound trafficnet/ net/ | +0 | 2 replies | |
| 5/7 | secid reconciliation-v02: Label locally generated IPv6 trafficinclude/ net/ net/ | +0 | 0 replies | |
| 6/7 | secid reconciliation-v02: Label locally generated IPv4 trafficinclude/ include/ net/ +3 more | +0 | 1 reply | |
| 7/7 | secid reconciliation-v02: Enforcement for SELinuxsecurity/ security/ security/ +2 more | +0 | 3 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH 0/7] secid reconciliation-v02: Repost patchset with updates
The following are the changes included in this patchset since the previous post:
- Perform flow_in check before (as opposed to after) computing transition secid on inbound; this seems more intuitive and correct.
- Implement reconciliation and flow control for outbound traffic (forward case being a sequence of inbound checks followed by outbound checks).
- Make selinux_xfrm_postroute_last checks conditional on compat_net.
This patchset is relative to David Miller's net-2.6.19.git (last updated on Sep 1st).
Please consider for inclusion in 2.6.19.
UPCOMING WORK:
The following per the discussion at:
http://marc.theaimsgroup.com/?l=selinux&m=115755980516072&w=2
- Create IPSec SAs to be acquired with the creating sock's context as opposed to that of the matching SPD rule, resulting in a simpler SPD as well as policy.
- Set peer_sid on tcp sockets to the reconciled secmark so trusted applications can retrieve and service the data at the appropriate context.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.