From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Fri, 3 May 2013 09:23:53 -0400
Subject: [refpolicy] [RFC] Removal of unlabeled_t packet rules
Message-ID: <5183BA69.5020901@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

Back when the SECMARK implementation was new, the packet class was always checked.  Because of that, unlabeled_t packet rules proliferated refpolicy since the common case was to have no SECMARK rules.  Since then, the kernel has been modified to only enforce the packet class if there are SECMARK rules.  I believe the unlabeled_t packet rules should be removed, since users of SECMARK will likely want no unlabeled_t packet rules, and the common case users will have no impact since the packet class isn't enforced on their systems.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com