Re: Labeling traffic over loopback

• Venkat Yekkirala <vyekkirala@TrustedCS.com> wrote:

> The following describes a proposal to label traffic
> over loopback
> by using a bit in the sk_buff structure. We have:
>
> struct sk_buff {
> ...
> struct sec_path *sp;
> ...
> __u8 pkt_type:3,
> fclone:2,
> ipvs_property:1;
> ...
> }
>
> We could use an additional bit (local_label) to
> denote that
> "sp" holds the source label sid (no blob, so no
> lifecycle mgmt).
>
> What do people think?

I can't speak for other people, but every time I've seen the space in a pointer stolen as storage for data it's lead to tears.
It may be expediant for the problem at hand, but you'll never be able to share the
interface* if you break it in this way.
If you must do this sort of thing use a union so that there's some hope of maintaining the interface moving forward.

• I know that it seems unlikely that you'll ever need to, but the network labeling scheme is reasonably attractive.

Casey Schaufler
casey@schaufler-ca.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.