[refpolicy] [RFC] Removal of unlabeled_t packet rules
Christopher J. PeBenito
cpebenito at tresys.com
Tue May 14 10:56:38 EDT 2013
On 05/03/13 09:23, Christopher J. PeBenito wrote:
> Back when the SECMARK implementation was new, the packet class was always checked. Because of that, unlabeled_t packet rules proliferated refpolicy since the common case was to have no SECMARK rules. Since then, the kernel has been modified to only enforce the packet class if there are SECMARK rules. I believe the unlabeled_t packet rules should be removed, since users of SECMARK will likely want no unlabeled_t packet rules, and the common case users will have no impact since the packet class isn't enforced on their systems.
Since there have been no objections, the rules have been removed.
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
More information about the refpolicy