I'm interested in how SELinux effects the processing of packets through the networking stack. I've found the following questions and answers:
The first seems to imply that SELinux can tag packets (kind of like tagging VLANs), and processing can differ depending on the tags associated with the packets. This makes sense to me. However, the second question is asking about network access via user groups and access controls. It's unclear based on the answer and comments if this is true, or how it's possible.
When reading through the Linux Kernel source code (2.6.16, I know its old but a lot of embedded devices still use 2.6), you come across the file
/security/selinux/hooks.c. This has functions like
selinux_parse_skb_ipv4, selinux_socket_create, selinux_socket_bind, etc.
My questions are:
- Can someone clear up the second question for me? Either by actually answering that question, or answering it here.
- Does SELinux affect the network stack in any other ways?
- With functions like the ones listed above, is SELinux used to create the abstract concept of a "secure socket"? Much like the Windows API provides function calls to create "secure sockets".