From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Tue, 14 May 2013 10:56:38 -0400
Subject: [refpolicy] [RFC] Removal of unlabeled_t packet rules
In-Reply-To: <5183BA69.5020901@tresys.com>
References: <5183BA69.5020901@tresys.com>
Message-ID: <519250A6.6040201@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 05/03/13 09:23, Christopher J. PeBenito wrote:
> Back when the SECMARK implementation was new, the packet class was always checked.  Because of that, unlabeled_t packet rules proliferated refpolicy since the common case was to have no SECMARK rules.  Since then, the kernel has been modified to only enforce the packet class if there are SECMARK rules.  I believe the unlabeled_t packet rules should be removed, since users of SECMARK will likely want no unlabeled_t packet rules, and the common case users will have no impact since the packet class isn't enforced on their systems.
 
Since there have been no objections, the rules have been removed.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com