On Fri, Feb 28, 2014 at 05:10:47PM -0500, Paul Moore wrote:

On Friday, February 28, 2014 11:10:07 AM Nikolay Aleksandrov wrote:

quoted

On 02/28/2014 08:23 AM, Steffen Klassert wrote:

quoted

Looking at the git history, it seems that this bug is about nine
years old. I guess noone is actually using this.

Most (all?) of the labeled IPsec users use the netlink interface and not pfkey 
so it isn't surprising that this has gone unnoticed for some time.

Right, that's not really surprising. But it is a bit surprising that
we care for the security context only if we add a socket policy via
the pfkey key manager. The security context is not handled if we do
that with the netlink key manager, see xfrm_compile_policy().

I'm not that familiar with selinux and labeled IPsec, but maybe this
needs to be implemented in xfrm_compile_policy() too.