Weekly Edition
Return to the Kernel page
| |||||||||||||
Secmark explained
James Morris's secmark
patches have been circulating for a few weeks now. Secmark is a new
mechanism for filtering network packets through SELinux. Your editor had
pondered writing an article about secmark, but that turns out to be
unnecessary; James did it first.
The idea is to separate labeling and enforcement. Specifically:
use iptables to select and label packets, then use SELinux to
enforce security policy using these packet labels. This utilizes
the expressiveness of iptables rulesets, as well as the flexibility
of any its many matches and targets, and powerful components such
as connection tracking. At the same time, enforcement of security
policy remains the responsibility of the SELinux AVC, and access
control rules can be meaningfully analyzed as part of overall
SELinux policy analysis.
Read the full article for a detailed description of what secmark does and how to use it. (Log in to post comments)
Secmark explained Posted May 25, 2006 15:06 UTC (Thu) by dang (guest, #310) [Link] The more that I think about this, the more that I like it. Very cool.
<troll_prevention>
|
|||||||||||||