Re: [RFC PATCH v3 00/13] Labeled networking patches for 2.6.28

[Joe Nall <joe@xxxxxxxx>]

On Aug 21, 2008, at 4:25 PM, Paul Moore wrote:

> Another update to the labeled networking patches for 2.6.28.  This  
> revision
> adds some small fixes, the dead-code removal patch posted earlier,  
> and the big
> addition ... wait for it ... full LSM label/context support for local
> connections.  This is accomplished by creating a new, private CIPSO  
> tag type
> (allowed by the spec with a tag number > 127) which carries the  
> LSM's secid
> value, allowing full LSM contexts to be carried across local  
> connections
> without the headaches of labeled IPsec.
>
> For those of you interested in testing this out, you will need the  
> latest
> from the netlabel_tools addrsel branch, revision 74 or higher should  
> work.
> If you enable the new local labeling you will almost certainly need  
> to run
> SELinux in permissive mode since I'm fairly certain the current  
> policies don't
> have the necessary allow rules.  With that said, enabling the new  
> local
> labeling is pretty easy ...

Paul created a 2.6.26 patch which I've been testing with excellent  
results in Fedora 9. Local (lo and ethN) labeled networking is more  
reliable than the IPSec equivalent and does not have the IPSec SA  
creation latency. I'll push this to a larger set of developers and  
testers next week and report any issues.

joe

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html