Date: Thu, 7 Feb 2008 12:44:44 +0100
From: Ingo Molnar <mingo@elte.hu>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: David Miller <davem@davemloft.net>, linux-kernel@vger.kernel.org,
       netdev@vger.kernel.org, Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: [bisected] Re: [bug] networking broke, ssh: connect to port
	22: Protocol error
Message-ID: <20080207114444.GA387@elte.hu>
References: <20080206133506.GA21202@elte.hu> <657224.72762.qm@web36615.mail.mud.yahoo.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <657224.72762.qm@web36615.mail.mud.yahoo.com>
User-Agent: Mutt/1.5.17 (2007-11-01)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 965
Lines: 23


* Casey Schaufler <casey@schaufler-ca.com> wrote:

> > So unlike some other security modules like SELINUX, enabling SMACK 
> > breaks un-aware userspace and breaks TCP networking?
> > 
> > I dont think that's expected behavior - and i'd definitely like to 
> > enable SMACK in automated tests to check for regressions, etc.
> 
> As Stephen mentions later, Smack uses CIPSO. sshd does not like any IP 
> options because of traceroute, and must be built with that check 
> disabled with the current Smack version. I have been looking at using 
> unlabeled packets for the "ambient" label, it appears that doing so 
> would make life simpler. I will get right on it.

ok - feel free to send me any patches to test.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/