I am currently working on a series of patches to add support for static external network labels to NetLabel/SELinux. The idea is that a user could define a physical interface, IP address, address mask, and context which would be applied as an external label to the packet when an explicit label was not present. This is similar to other trusted OSs which allow administrators to assign labels to single level, unlabeled networks. For those of you following the SELinux list it was discussed a month or two ago. This is relevant to the audit subsystem because adding/removing these address/context entries should most likely be audited for the same reasons we audit other NetLabel or XFRM labeling related configuration changes. To accomplish this I would like to suggest the addition of the following record types, comments? #define AUDIT_MAC_UNLBL_STATICADD 14XX /* NetLabel: add a static label */ #define AUDIT_MAC_UNLBL_STATICDEL 14XX /* NetLabel: del a static label */ -- paul moore linux security @ hp