On Wednesday 01 October 2008 5:55:49 am James Morris wrote: > It might be better in the long term to integrate this stuff more > directly with the core networking. Agreed. I did it the way I did because I wanted to impact the core stack as little as possible. I looked at potentially doing the work in ip_options_compile() but that was going to require a lot of tweaking and some rather ugly hacks to keep everything contained and off to the side. Tighter integration with the core stack can always be treated as an optimization at a later date; I want to see what our IPv6 needs will be first and I don't have a clear picture of that just yet. On the plus side, only traffic coming from unconnected sockets is going to be hit by this and with most stuff using TCP these days I'm hopeful that the impact to the SELinux folks using labeled networking will be _relatively_ minimal. -- paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
