Re: [bisected] Re: [bug] networking broke, ssh: connect to port 22: Protocol error

* Casey Schaufler [off-list ref] wrote:

quoted

So unlike some other security modules like SELINUX, enabling SMACK 
breaks un-aware userspace and breaks TCP networking?

I dont think that's expected behavior - and i'd definitely like to 
enable SMACK in automated tests to check for regressions, etc.

As Stephen mentions later, Smack uses CIPSO. sshd does not like any IP 
options because of traceroute, and must be built with that check 
disabled with the current Smack version. I have been looking at using 
unlabeled packets for the "ambient" label, it appears that doing so 
would make life simpler. I will get right on it.

ok - feel free to send me any patches to test.

	Ingo