For those not on the main SELinux list (or netdev or netfilter-devel),
I've just posted an RFC and patches for a new scheme for per-packet
network controls.
See:
http://thread.gmane.org/gmane.linux.network/34927/focus=34927
http://people.redhat.com/jmorris/selinux/secmark/
- James
--
James Morris
<jmorris(a)namei.org>