|Main Archive Page > Month Archives > selinux archives|
Paul Moore wrote: > On Thursday 09 August 2007 10:09:14 am Darrel Goeddel wrote:
>> Because of the position I am in (needing to find something workable for
>> users), I have been trying to get my head aounrd the state of SELinux
>> the ideas that have been talked about in the past, and how we can prevent
>> SELinux networking infrastructure from resembling a Rube-Goldberg
>> be presenting some of the problems I perceive along with some very high
>> ideas early next week.
> Such a tease! ;)
Here's a general high-level idea. Remember that this is in no way a
(yet) because I'm not even sure if it makes sense. It is a very simple idea,
but it should prove to be flexible enough to handle everything. I make no claims as to its workability, or it implementability given the fact that we should offer some kind of backwards compatibility. I think this would be something that one might come up with if they were starting from scratch (I seriously doubt that the current mechanisms would ever come out of an intentional up-front design). It is just a vision of my perfect scenario (perfect until I figure out that it doesn't do what I need it to do)... Please try to look at this from a clean slate as well as a retrofit point-of-view.
picture here: http://home.insightbb.com/~dgoeddel/networking/simple.png (when commenting, please refrain from belittling my artistic skills)
The high level ideas are (I'll be using sid and context interchangeably, but I think we can all figure that one out):
so, I think these ideas would: - provide flow control - enable loopback labeling - provide one label instead of three possibly conflicting labels for an skb - streamline, simplify, make sense of access checks regarding skbs - simplify understanding of what the skb context is - the peer's context - enable a more reliable, safe, and informative getpeercon result
I'm not sure that any of these ideas are particularly new, but I'm hoping that this particular combination of previously presented ideas makes a bit of sense. I'm sure that I will get tons of useful commentary to incorporate, and I thank you in advance :) That's why I wanted to toss something out there now.
I'm off for a weekend trip, so please don't feel that I am ignoring all of the scathing criticisms that will be coming tomorrow... I'll ignore all of that next week when I return ;)
We'll be working through some prototypes to make sure that the ideas that we present are at least somewhat feasible - unlike the blue sky idea presented here (although that'll get prototyped to see if it is workable - I hope it is). -- Darrel -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to firstname.lastname@example.org with the words "unsubscribe selinux" without quotes as the message.