[lkml]   [2010]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 3/6] secmark: export binary yes/no rather than kernel internal secid
On Fri, 24 Sep 2010, Eric Paris wrote:

> Currently the nfconntrack export code sends the kernel internal secid to
> userspace in a couple of proc files and over netlink as an integer. This
> is wrong. This number is a kernel internal.

I wouldn't say wrong, exactly.

The secid is a 32-bit integer which each LSM maps to its own domain.
It's unlikely to change from this format (we were v. lucky to get this
field, btw).

There's really no difference between this and the various kernel addresses
exported via procfs by the networking code -- it's an opaque token which
you can use to identify the security marking of a packet without
necessarily having any knowledge of the security model itself.

It's potentially useful for debugging and writing simple userland tools,
and may be in use already by apps.

> This patch changes the export
> code to output either 0 or 1 for this value.

This potentially breaks existing apps and does not seem to add any value
itself. If you want to determine if a packet is marked, then simply check
for zero or not.

> A future patch will implement sending the name rather than the number
> in a new field.

For the reasons above, I think the secctx string needs to be exported in
addition to this rather than instead of.

- James
James Morris

 \ /
  Last update: 2010-09-27 20:11    [W:0.307 / U:20.060 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site