|
Hello, I am trying to set up a system using SELinux system that needs to have certain network traffic blocked based on the MLS label. Basically, there are two machines running SELinux (call them A and B). Both machines have two processes, say
A1 and B1 are at sensitivity s0, and A2 and B2 are at s1. I want to let process A1 talk to B1, and A2 talk to B2, but block A1->B2, and A2->B1. Without using labeled IPsec, what systems for network labeling should I use? With the Netlabel fallback labels I
am not able to specify the port. I currently am setting the label via secmark based on the source, destination, and port, and then running each process at the appropriate level, and also have the port labeled at the appropriate level. This is not blocking
the traffic I want it to. I have been reading Paul Moore’s blogs about Secmark and network labeling and am a little bit confused about packet vs. peer labeling. Are both packet and peer labeling required? If both are, am I out of luck since Netlabel can not specify
a port? If only packet labeling is required, what is causing the scheme explained above to not block traffic? Thank you, Blake Langland |
