[redhat-lspp] Creating a context/SID for MLS CIPSO packets
Paul Moore
paul.moore at hp.com
Thu Mar 16 18:26:00 UTC 2006
Traditional CIPSO only sends the MLS label along with the packet. This
is fine for traditional MLS systems but causes problems here in TE land.
The problem being, how does one create a full SELinux context/SID with
only the MLS label?
From my limited knowledge of the security server, it looks like the
best way is to create a new entry in the policy's default context field,
policydb->ocontexts[OCON_NETLBL], with a default context minus the MLS
label. Whenever a MLS CIPSO packet arrives I could generate a context
using the default context and the MLS label and do a sidtab_search().
If the results did not yield an existing SID I would insert the new
context into the SID table.
So SELinux gurus I ask you, is that a reasonable approach? Or am I
missing something here and way off base?
--
paul moore
linux security @ hp
More information about the redhat-lspp
mailing list