On Thu, 2006-09-28 at 23:52 -0400, Joshua Brindle wrote:
> Venkat Yekkirala wrote:
> > <snip>
> > +
> > + err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
> > + PACKET__FLOW_IN, NULL);
> > + if (err)
> > + goto out;
> > +
> > + if (xfrm_sid) {
> > + err = security_transition_sid(xfrm_sid, skb->secmark,
> > + SECCLASS_PACKET, &trans_sid);
> > + if (err)
> > + goto out;
> > +
> >
> I thought we weren't doing transitions to label packets anymore per the
> conference call?
No, transitions are still part of the reconciliation process. By
default, this just means that we end up with the xfrm_sid (which is what
you want). But it allows us the freedom to define transitions on the
secmark label if desired, and those transitions can still yield subject
labels.
--
Stephen Smalley
National Security Agency
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
