> > > Former (multicast modifications of fabric) also requires restricting > > > arbitrary UD QPs as well as QP1 as SA access is QPn (n > 0) <-> QP1. > > > > The SA could have an option to ignore all requests that do not originate > QP1, > > then protect access to QP1 on the client nodes. > > I'm not really sure what we are protecting against here. Is it simply DoS > against the SA? This would protect against a non-privileged QP trying to change multicast or event subscription, for example. Though it could help with DoS, by avoiding the processing associated with requests. Jason's original question was why would you want to leave qp1 open, and I think the answer to that depends on what restrictions could be enforced for qpX: X > 1. Restricting both seem desirable, IMO. _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
