lkml.org 
[lkml]   [2010]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 3/6] secmark: export binary yes/no rather than kernel internal secid
    On Fri, 24 Sep 2010, Eric Paris wrote:

    > Currently the nfconntrack export code sends the kernel internal secid to
    > userspace in a couple of proc files and over netlink as an integer. This
    > is wrong. This number is a kernel internal.

    I wouldn't say wrong, exactly.

    The secid is a 32-bit integer which each LSM maps to its own domain.
    It's unlikely to change from this format (we were v. lucky to get this
    field, btw).

    There's really no difference between this and the various kernel addresses
    exported via procfs by the networking code -- it's an opaque token which
    you can use to identify the security marking of a packet without
    necessarily having any knowledge of the security model itself.

    It's potentially useful for debugging and writing simple userland tools,
    and may be in use already by apps.

    > This patch changes the export
    > code to output either 0 or 1 for this value.

    This potentially breaks existing apps and does not seem to add any value
    itself. If you want to determine if a packet is marked, then simply check
    for zero or not.

    > A future patch will implement sending the name rather than the number
    > in a new field.

    For the reasons above, I think the secctx string needs to be exported in
    addition to this rather than instead of.


    - James
    --
    James Morris
    <jmorris@namei.org>


    \
     
     \ /
      Last update: 2010-09-27 20:11    [W:2.650 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site