From: sven.vermeulen@siphos.be (Sven Vermeulen)
Date: Fri, 3 May 2013 20:08:06 +0200
Subject: [refpolicy] [RFC] Removal of unlabeled_t packet rules
In-Reply-To: <5183BA69.5020901@tresys.com>
References: <5183BA69.5020901@tresys.com>
Message-ID: <20130503180806.GB22935@siphos.be>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Fri, May 03, 2013 at 09:23:53AM -0400, Christopher J. PeBenito wrote:
> Back when the SECMARK implementation was new, the packet class was always checked.  Because of that, unlabeled_t packet rules proliferated refpolicy since the common case was to have no SECMARK rules.  Since then, the kernel has been modified to only enforce the packet class if there are SECMARK rules.  I believe the unlabeled_t packet rules should be removed, since users of SECMARK will likely want no unlabeled_t packet rules, and the common case users will have no impact since the packet class isn't enforced on their systems.

Does that mean that, once an admin marks a particular rule with a security
context (even if it is just a single rule) that the administrator has to
(1.) explicitly mark all network traffic, and (2.) grant all network facing
domains access to that marked traffic?

Wkr,
	Sven Vermeulen