On Tue, 28 Apr 2020 19:45:56 +0530, Suraj Upadhyay said: > I saw a kernel project on kernelnewbies.org [1]. > Which goes like this :- > > > Implement network interfce default labeling for Smack. > > > Today all unlabeled networking traffic is treated with one > > "ambient" Smack label. This project consists of taking advantage > > of mechanisms already in the labeled networking code to allow > > different labels to be assigned to packets based on the itnerface > > upon which they appeared. > > > Difficulty 5. > > I see that the project has not been done yet, as I cannot find any > described implementation, correct my if I go wrong here. > > I really want this to be my first kernel project. I am a relatively > new comer to the community, and I want to contribute in all my capacity. Note that this is a lot harder to do correctly than it looks. For starters, it's not entirely obvious that "label according to interface" is the best semantic. A better one is probably "based on packet origin" - which gets interesting now that Wireguard has landed in the kernel. VLANs need to be considered, and you *definitely* want to re-use the CONFIG_NETWORK_SECMARK code that AppArmor and SELinux use for network packets. Also, supporting CIPSO would be pretty much mandatory... And looking at Documentation/admin-guide/LSM/Smack.rst, it appears that SMACK is a lot more label-aware than the project description indicates. In any case, I'm quite sure that Casey will agree with me that "Here There Be Dragons". :)
Attachment:
pgp7rg9qq7ap5.pgp
Description: PGP signature
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@xxxxxxxxxxxxxxxxx https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
