Subject: Re: [RFC PATCH v6 11/16] netlabel: Add functionality to set the security attributes of a packet

From: Paul Moore <[email-masked]>
Date: Wed, 1 Oct 2008 12:51:12 -0400

On Wednesday 01 October 2008 5:55:49 am James Morris wrote:
> It might be better in the long term to integrate this stuff more
> directly with the core networking.

Agreed.  I did it the way I did because I wanted to impact the core 
stack as little as possible.  I looked at potentially doing the work in 
ip_options_compile() but that was going to require a lot of tweaking 
and some rather ugly hacks to keep everything contained and off to the 
side.  Tighter integration with the core stack can always be treated as 
an optimization at a later date; I want to see what our IPv6 needs will 
be first and I don't have a clear picture of that just yet.

On the plus side, only traffic coming from unconnected sockets is going 
to be hit by this and with most stuff using TCP these days I'm hopeful 
that the impact to the SELinux folks using labeled networking will be 
_relatively_ minimal.

-- 
paul moore
linux @ hp