Can Red Hat Linux 6 KVM support of Windows Guest OS be configured to add CIPSO security labels for network packets generated by Windows Guest OS and validate CIPSO label for incoming network packets to the Windows Guest OS?

From documentation, such doesn't seem possible but wanted to check in case I'm missing something.

IMHO this isn't about what Linux (Netlabel) supports but what other OSes do. And Microsoft Windows definitely does not AFAIK.

I recognize that Windows doesn't support security labeling of packets. I'm hoping (but not expecting) to identify a KVM + Netlabel configuration to support a) multiple Windows Guest OS instances of different security classifications (for example, Secret and Top Secret) to run on top of KVM with b) IP packets originated from applications in each Guest OS security instance being labeled with the appropriate security classification, c) incoming IP packets delivered to a given Windows Guest OS instance only if they are labeled with the appropriate security classification, and d) in a manner transparent to the Windows Guest OS instances and their applications.

This would require that KVM + NetLabel be able to intercept packets from/to Windows Guest OSs and a) modify outgoing packets to insert the appropriate security level and b) verify the correct security label for incoming packets and then modify the incoming packets to remove the security label. The label to be used for a given Windows Guest OS instance would need to be statically configured.

I don't think there is any way to do this but my level of understanding is only cursory so want to make sure before I give up on this possible multi-level secure architecture for Window applications.

As the label is applied to a socket maybe a traffic-forwarding MitM could work but ...


...as with all things MitM it doesn't actually prove anything security-wise about the machines or applications behind it so calling it a "multi-level secure architecture" would be a travesty IMHO. While I'm not sure from your reply if you are forced to label traffic or if confining, isolating it could do and while NuFW is not the same as {CALI,C,R}IPSO and only works with compatible machines it might be worth having a look at just to see what's possible?


Netlabel / CIPSO:
http://www.kernel.org/doc/Documentat...cipso_ipv4.txt
http://netlabel.sourceforge.net/
http://netlabel.svn.sourceforge.net/...67&view=markup
the RFC's you can find yourself.

NuFW / Edenwall:
http://freecode.com/projects/nufw
and see http://web.archive.org/web/201107172.../www.nufw.org/ as nufw.org and edenwall.com are gone.

A bit more context - the network architecture employs guards between single level security enclaves and a multi-security level Unix workstation enclave. The current cross-domain guards only let thru network packets which are appropriately labeled. The desire is to also provide Windows application services within the existing multi-security level LAN without having to replace or modify the cross-domain guards.

Thus the desire to find a method of labeling packets to/from Windows guest OS in a manner transparent to the Windows guest OS and its applications.

Well, on to testing then. http://free.linux.hp.com/~pmoore/fil...n-07092008.pdf and http://paulmoore.livejournal.com/2884.html seem to convey it's not impossible but you'll have to do some hefty reading. See http://paulmoore.livejournal.com/tag/netlabel and consult with him on the https://admin.fedoraproject.org/mail...stinfo/selinux mailing list I'd say.