One of the new features added in Linux 2.6.28 was the ability to send full SELinux labels/contexts over local connections using NetLabel. Unfortunately a bug was recently discovered in how NetLabel applies on-the-wire security labels to responses of incoming TCP connections which significantly affects the native labeling added in 2.6.28. The bug ( Read more... )

One of the biggest differences between NetLabel and the labeled networking mechanisms of existing Trusted OSs is how outbound traffic is selected for labeling. Ever since NetLabel was first introduced in kernel 2.6.19 the on-the-wire outbound labeling protocol was determined by the label of the sending application's socket. Despite the departure ( Read more... )

Yesterday I announced a new release of the NetLabel Tools package and promised a post detailing the new labeled networking features in Linux 2.6.28. James Morris saw that and called me out in his nice summary of the security relevant changes in the 2.6.28 release, so I guess I had better make good on my promise ( Read more... )

A new version of the Netlabel Tools package has been released. Version 0.19 includes support for the new features found in Linux Kernel 2.6.28 (more on that later) as well as a number of improvements to the code which aren't always user-visible. Hit the links in this post to get the latest bits.

NetLabel userspace download: netlabel_tools ( Read more... )

I've already talked about Fallback Labels and Network Peer Controls now I'm going to explain the last major labeled networking feature included in the 2.6.25 release of the Linux Kernel, the network ingress/egress controls. One of the longstanding problems with the SELinux network access controls was that they lacked any ability to control packets ( Read more... )

In addition to Fallback Labels another new feature added to the 2.6.25 release of the Linux Kernel was the consolidation of the access control permissions for the different peer labeling mechanisms supported by SELinux. This consolidation has several benefits including better handling of traffic with multiple peer labels (all of the labels must be ( Read more... )

One of the new features added to the 2.6.25 release of the Linux Kernel was the ability to specify fallback peer labels using NetLabel. This made it possible for system administrators to specify a peer label to be used in the absence of a peer labeling protocol such as CIPSO or Labeled IPsec. In this post I'll try to provide a quick introduction ( Read more... )

Thanks to James Morris for pointing out that the Linux Foundation Japan videos are now online. I've put a copy at the link below. All I ask is that you remember I had been in Japan less than a day when this was filmed and was still dealing with a 13 hour time difference :)

Video download: Introduction to Labeled Networking on Linux

I'm at OLS right now, but the day before OLS started we held this year's SELinux Developer's Summit as part of OLS's mini-summit program. This year's summit was a bit of a departure from previous years in that the summit consisted of several short presentations and was open to everyone. Personally, I thought it went very well, with lots of good ( Read more... )

When I think about all of the items on my Linux Labeled Networking todo list one of the items that stands out the most is the lack of good, useful documentation. Oh sure, there is some documentation available, for instance Joshua Brindle's blog post about Labeled IPsec on SELinux, but most of it is quickly becoming dated and no longer a good fit ( Read more... )