Subject: Re: [bisected] Re: [bug] networking broke, ssh: connect to port 22: Protocol error

From: Ingo Molnar <[email-masked]>
Date: Thu, 7 Feb 2008 12:44:44 +0100

* Casey Schaufler <[email-masked]> wrote:

> > So unlike some other security modules like SELINUX, enabling SMACK 
> > breaks un-aware userspace and breaks TCP networking?
> > 
> > I dont think that's expected behavior - and i'd definitely like to 
> > enable SMACK in automated tests to check for regressions, etc.
> 
> As Stephen mentions later, Smack uses CIPSO. sshd does not like any IP 
> options because of traceroute, and must be built with that check 
> disabled with the current Smack version. I have been looking at using 
> unlabeled packets for the "ambient" label, it appears that doing so 
> would make life simpler. I will get right on it.

ok - feel free to send me any patches to test.

	Ingo