Fw: Question regarding SELinux and IPsec

From: Trent Jaeger <jaegert_at_us.ibm.com>
Date: Tue, 8 Mar 2005 12:53:52 -0500

Here is the correct answer to Paul Moore's question regarding a standard for extending IKE payloads with security contexts.

We are *not* using a draft design, but are simply adding the context string to the negotiation.

Apologies for the confusion.

Regards,
Trent.

---

Trent Jaeger
IBM T.J. Watson Research Center
19 Skyline Drive, Hawthorne, NY 10532
(914) 784-7225, FAX (914) 784-7225
----- Forwarded by Trent Jaeger/Watson/IBM on 03/08/2005 12:50 PM -----

Serge E Hallyn
03/08/2005 11:35 AM

        To:     Trent Jaeger/Watson/IBM
        cc:     Joy Latten/Austin/IBM, Paul Moore <paul.moore@hp.com>
        Subject:        Re: Fw: Question regarding SELinux and IPsec

Our original sec_ctx in our first prototype implemented the Sensitivity Extension (SADB_SENS) in the pfkey rfc (RFC2367 at http://www.faqs.org/rfcs/rfc2367.html).

We dropped that when we followed James' or Stephen's suggestion about sending the plaintext context instead. So we no longer explicitly follow any draft. Perhaps we should be looking into amending the draft, but if I understand correctly other Linux-specific extensions have also not been fed back.

-serge

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Received on Tue 8 Mar 2005 - 12:58:41 EST