selinux June 2013 archive
Main Archive Page > Month Archives  > selinux archives
selinux: Re: [PATCH v3 0/2] Fix the SELinux dynamic network acce

Re: [PATCH v3 0/2] Fix the SELinux dynamic network access controls

From: Paul Moore <pmoore_at_nospam>
Date: Mon Jun 03 2013 - 15:11:38 GMT
To: David Miller <>,

On Friday, May 31, 2013 05:31:08 PM David Miller wrote:
> From: Paul Moore <>
> Date: Wed, 29 May 2013 13:36:18 -0400
> > Take #3 ... two changes here: the first is a simple reordering of the
> > two patches and the second is stripping the SELinux patch (2/2 in this
> > patchset) of everything but the bare bones changes needed to fix the
> > problem in the 3.10-rcX tree.
> Series applied, but longer term I'd like to see this handled by generation
> counts or similar during lookup time.
> Doing a GC every policy delete hurts policy delete performance, something
> we worked really hard to make as light weight as possible given the
> constraints.

Thanks for pulling in the fixes for 3.10-rcX.

I promise to take a look at changing our approach to detecting an active
labeled IPsec configuration for future releases. I need to cleanup our
labeled IPsec code anyway, it is in need of some TLC (you saw some of the
changes in the earlier version of this patchset).

-- paul moore security and virtualization @ redhat -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to with the words "unsubscribe selinux" without quotes as the message.