On Tue, 28 Apr 2020 19:45:56 +0530, Suraj Upadhyay said:
I saw a kernel project on kernelnewbies.org [1]. Which goes like this :-
Implement network interfce default labeling for Smack.
Today all unlabeled networking traffic is treated with one "ambient" Smack label. This project consists of taking advantage of mechanisms already in the labeled networking code to allow different labels to be assigned to packets based on the itnerface upon which they appeared.
Difficulty 5.
I see that the project has not been done yet, as I cannot find any described implementation, correct my if I go wrong here.
I really want this to be my first kernel project. I am a relatively new comer to the community, and I want to contribute in all my capacity.
Note that this is a lot harder to do correctly than it looks. For starters, it's not entirely obvious that "label according to interface" is the best semantic. A better one is probably "based on packet origin" - which gets interesting now that Wireguard has landed in the kernel. VLANs need to be considered, and you *definitely* want to re-use the CONFIG_NETWORK_SECMARK code that AppArmor and SELinux use for network packets. Also, supporting CIPSO would be pretty much mandatory... And looking at Documentation/admin-guide/LSM/Smack.rst, it appears that SMACK is a lot more label-aware than the project description indicates. In any case, I'm quite sure that Casey will agree with me that "Here There Be Dragons". :)