(racoon 747) Re: [PATCH] setkey support for sadb_sens

Michal Ludvig <[email protected]> wrote:
> On Wed, 15 Sep 2004, Serge Hallyn wrote:
>
> > Attached please find a patch which implements support in setkey for the
> > PF_KEY sensitivity extension.  We have been using this with several
> > (patched) versions of linux.  If there are no fundamental objections to
> > adding this support, then we will of course also need to patch racoon.
>
> Could you briefly explain what is it good for, please?

It allows you to associate sensitivity and integrity data with a
particular connection under a particular algorithm/key.  This is a
part of the PF_KEY RFC 2367 which has not yet been implemented.  We
use this to provide MLS and SELinux network flow controls.  The
sensitivity of a connection is used to refuse a local process
the right to send or receive data of an inappropriate level.
For instance, a policy can ensure that "top secret", or perhaps
syslog_t, data is exported only over "top secret", well-protected
connections.

thanks,
-serge