Label eth0 with a MCS security category?

[Jason Shaw]

In FC-11, under the targeted policy, is it possible to label an ethernet
interface (such as eth0, eth1) with a specific MCS category?

Example:
1) Use semanage to assign user1 to s0:c5
3) Assign eth0 to s0:c4 (Can this be done?)
4) Assign eth1 to s0:c5

Desired result: if user1 tries to ping -I eth1 <ip_address> the ping command
will work (as both eth1 and user1 have category c5). If user1 tries to ping
-I eth0 <ip_address>, the ping command will not work (category mismatch
between user and eth1).

[James Morris]

On Fri, 21 Aug 2009, Jason Shaw wrote:

>  In FC-11, under the targeted policy, is it possible to label an
> ethernet
>  interface (such as eth0, eth1) with a specific MCS category?
>  
>  Example:
>  1) Use semanage to assign user1 to s0:c5
>  3) Assign eth0 to s0:c4 (Can this be done?)
>  4) Assign eth1 to s0:c5
>  
>  Desired result: if user1 tries to ping -I eth1 <ip_address> the ping command
>  will work (as both eth1 and user1 have category c5). If user1 tries to ping
>  -I eth0 <ip_address>, the ping command will not work (category mismatch
>  between user and eth1). 
It should be possible to do this via iptables and SECMARK.

i.e. match all packets on ethN and label with the MCS category then use 
the SELinux packet flow policy rules.

I haven't looked at this stuff for a while, so cc'ing Paul Moore, who 
maintains the code.

-- 
James Morris
<jmorris(a)namei.org&gt;

Adding AV assertion to selinux policy in RHEL5

[Anamitra Dutta Majumdar]

We are looking for a well documented procedure to add AV assertion to
selinux policy on RHEL5.
So far all SELinux URL links refer to the fact that the AV assertion
needs to be added to assert.te file under $SELINUX_SRC folder.
This appears to be true only for RHEL4 not RHEL5 since there is no src
folder under /etc/selinux/targeted that contains the source policies in
RHEL5.
We have installed and built the selinux-policy-2.4.6-248.el5.src.rpm on
our RHEL5.4 box and we did not find any assert.te file.
Can someone help us with the exact method as to what needs to be done to
add an AV assertion rule to our policy.

Thanks
Anamitra & Radha