Stephen Smalley wrote: > On Fri, 2006-09-29 at 10:33 -0400, James Morris wrote: > >>On Fri, 29 Sep 2006, Stephen Smalley wrote: >> >> >>>However, since the transition was removed in the flow_out case, it would >>>be logical to remove it from the flow_in case as well, and that would >>>have the side benefit of less overhead. >> >>How about adding secmark transitions later, if needed, perhaps with an >>/selinux config control ? >> >>It does keep things simpler for now, in terms of getting this code merged, >>deployed into distros and likely certified. > > > Fine with me, unless Venkat has an immediate use case for such > transitions in the flow_in case (but I think this is mostly my fault for > suggesting transitions a while ago).
Unless I'm confusing something, there still may be a need for transitions if we want to support both IPsec and NetLabel labeling on the same connection. If we don't support transitions and allow both labeling methods on the same connection we'll need to decide how to handle resolving the two - maybe use a transition is this one case? -- paul moore linux security @ hp - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
