Re: netif labelling

> I think you indeed have to declare new network interface types if you > want to differentiate between the various network interfaces in targeted > policy using network_interface() > This is what is defined in corenetwor.te.m4: # # network_interface(if_name,linux_interface,mls_sensitivity) # define(`network_interface',` gen_require(``type unlabeled_t;'') type $1_netif_t alias netif_$1_t, netif_type; declare_netifs($1_netif_t,shift($*)) ') So, by that I am assuming that if I include 'network_interface(tun0,tun0,s0)' (in corenetwork.te.in instead of 's0' there is 's0 - mls_systemhigh' - does that matter?) in my policy file this is all I need to do, right?

Also, as part of the policy I wish to enable/restrict the program to connect on mysqld port, but ONLY on the local (lo) interface and then listen/bind on a predefined port but on the tun0 interface. How do I do that? There are 2 relevant macros in corenetwork.te.m4 for this: corenet_tcp_bind_voip_sandbox_port(voip_sandbox_t) corenet_tcp_connect_mysqld_port(voip_sandbox_t)

which are taken from: ######################################## ## <summary> ## Bind TCP sockets to the $1 port. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> ## <infoflow type="none"/> # interface(`corenet_tcp_bind_$1_port',` gen_require(` $3 $1_$2; ') allow dollarsone $1_$2:tcp_socket name_bind; $4 ') and ######################################## ## <summary> ## Make a TCP connection to the $1 port. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`corenet_tcp_connect_$1_port',` gen_require(` $3 $1_$2; ') allow dollarsone $1_$2:tcp_socket name_connect; ') For me it is clear that $1 is the port type (voip_sandbox and mysqld in my case) and 'dollarsone' expands to the parameter in brackets (voip_sandbox_t in my case), but what are $2, $3 and $4 (in the 1st macro above) and what values to these have? The <param> tag does not describe any of these and I cannot find any reference anywhere! Would SLIDE have picked up those?

If I manage to 'decipher' these I may restrict the above statements to the proper net device type if there is no suitable other macro found, but as it stands I am a bit stuck!