-
Layered Network Interfaces
If you've ever configured a tagged VLAN on a Linux system you know that for each VLAN ID on the system there exists a matching network interface, this is a nice feature that helps ease the pain of managing multiple VLANs but it presents an interesting question for SELinux administrators: how do the interface level access controls work? Since the ( Read more... ) -
Enabling the Network Ingress/Egress Controls
There have been quite a few questions lately about how to enable the SELinux network ingress/egress controls on recent Fedora releases. This is good because it means people actually want to use this stuff, but it is also bad because it tells me that I haven't done a very good job explaining how to use them. Actually, looking back on this site I ( Read more... ) -
LinuxCon NetLabel Presentation
I'm more than a little late posting this, but below you'll find a copy of the NetLabel presentation I gave at this past year's LinuxCon. Sure, it is old news, but if you ever wanted to know what NetLabel does and why it exists in the first place this is still good stuff.
Presentation download: NetLabel: What, Why & Where -
NetLabel Presentation and Tutorial at LinuxCon
In a few weeks I'll be giving a presentation and tutorial on NetLabel at LinuxCon. Both as a speaker and as a member of the audience I've always felt that the best presentations/tutorials are the ones that cover what the audience is really interested in hearing. The only problem is that in most cases the presentation material needs to be ( Read more... ) -
Labeled Networking in Linux 2.6.30 and 2.6.29.4
The labeled networking changes in 2.6.30 are fairly significant but not because of new features or functionality. The changes to 2.6.30 are largely fixes for bugs discussed previously as well as some minor improvements to Smack's internal labeled networking code. From a labeled networking user's point of view 2.6.30 doesn't do anything new, but ( Read more... ) -
Call For Security Proposals - LinuxCon and The Linux Plumbers Conference 2009
The week of September 20th is going to be a busy one with both LinuxCon and the Linux Plumbers Conference co-located in Portland, Oregon. However, having both conferences in the same place on the same week should make it much easier for people to justify the travel. If you are planning on attending one or both of the conferences you should know ( Read more... ) -
Transitioning to Secmark
Back in the 2.6.18 timeframe James Morris developed a replacement for the now-named "compat_net" SELinux access controls which filtered packets based on network attributes, the replacement was called Secmark. Secmark was introduced to fix two major issues with the aging compat_net access controls; the first problem being that they were not as ( Read more... ) -
Email Difficulties Part Two
It appears that my email account has hit internal routing issues yet again which means I haven't been receiving email since sometime on Friday evening. The truly unfortunate part of this (other than the fact that it happened _again_) is that with this being the weekend it is unlikely that this will get resolved until sometime next week. Sigh ( Read more... ) -
Email Difficulties
There was a problem with my email account last Friday, May 1st, which caused all mail sent to my account to bounce leading to lost mail and automatic forced removal from many mailing lists. Everything should be back to normal now, including my mailing list subscriptions, but if you sent me mail during the past few days and you haven't heard back ( Read more... ) -
Labeled Networking in Linux 2.6.29
While the 2.6.28 release of the Linux Kernel brought a lot changes to the labeled networking code the 2.6.29 release is much smaller with only a handful of fixes and a partially implemented new feature, single label host support for Smack. The new single label host support for Smack allows users to specify a single, static security label for a ( Read more... )