On Fri, 24 Sep 2010, Eric Paris wrote: > Currently the nfconntrack export code sends the kernel internal secid to > userspace in a couple of proc files and over netlink as an integer. This > is wrong. This number is a kernel internal. I wouldn't say wrong, exactly. The secid is a 32-bit integer which each LSM maps to its own domain. It's unlikely to change from this format (we were v. lucky to get this field, btw). There's really no difference between this and the various kernel addresses exported via procfs by the networking code -- it's an opaque token which you can use to identify the security marking of a packet without necessarily having any knowledge of the security model itself. It's potentially useful for debugging and writing simple userland tools, and may be in use already by apps. > This patch changes the export > code to output either 0 or 1 for this value. This potentially breaks existing apps and does not seem to add any value itself. If you want to determine if a packet is marked, then simply check for zero or not. > A future patch will implement sending the name rather than the number > in a new field. For the reasons above, I think the secctx string needs to be exported in addition to this rather than instead of. - James -- James Morris <jmorris@xxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
