On Wednesday 27 August 2008 4:06:55 pm Casey Schaufler wrote: > Yes, it would be weird to change the label on a TCP connection > midstream, but not unheard of. If you need an example think of > what you might want to do with a diskless boot, or some of the > less sophisticated clustering schemes. Speaking purely in regards to the current Linux implementation, the thing that concerns me about stream sockets is that it is difficult, if not impossible, to ensure that the relabel happens at a specific data boundary in the stream. Retransmission is another issue but might work okay depending where in the kernel the queue/retransmission takes place, I would need to check that. I suppose all of these things can be addressed but it would be take a little bit of work and until I see an application/user that needs this functionality I can't justify spending time on it (my todo list is already way too long). If you look carefully at the new labeled networking bits for 2.6.28 you will see that while we add the ability to change labeling based on the destination address, we do not allow labeling to change on an existing connection (although you can disconnect and reconnect a socket to a different destination allowing you to change the network labeling). -- paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
