Subject: Re: Is TCP over IPsec broken in 2.6.18?

From: Evgeniy Polyakov <[email-masked]>
Date: Sat, 30 Sep 2006 18:42:29 +0400

On Sat, Sep 30, 2006 at 06:40:18PM +0400, Evgeniy Polyakov ([email-masked]) wrote:
> On Sat, Sep 30, 2006 at 10:36:29AM -0400, James Morris ([email-masked]) wrote:
> > On Sat, 30 Sep 2006, Evgeniy Polyakov wrote:
> > 
> > > I need to cofirm that broken system in my setup does have selinux enabled 
> > > with enforcing mode.
> > > I've changed it to permissive mode and it fixed setup (I do not see any 
> > > warnings in dmesg).
> > 
> > Something better in your case would likely be to rebuild the kernel with 
> > CONFIG_SECURITY_NETWORK_XFRM=n until it's fixed.
> 
> Well, it is acrypto test machine and I do not care about security there,
> so I can even disable selinux completely, but it will not help to resolve
> the issue, right?
> 
> So if you have some patches I'm more than happy to test them.

And to confirm theory about CONFIG_SECURITY_NETWORK_XFRM I'm compiling
kernel without it (and then without selinux at all).

-- 
	Evgeniy Polyakov