I am looking at CALIPSO support for Smack. CALIPSO provides the same sort of network packet labeling for IPv6 that CIPSO provides for IPv4. Because most of the details are buried in the Netlabel code this should be reasonably straight forward. The complication is that Smack has two mechanisms in place for labeling IPv6 already, and neither uses anything like CALIPSO packet labeling. If CONFIG_SECURITY_SMACK_NETFILTER is defined Smack secids are sent via the netfilter secmark. Otherwise, the Smack label of the process creating a socket is maintained in a table indexed by the port number. My proposed change would make the IPv6 labeling match the IPv4 labeling. The entire port number scheme would be abandoned. The current secmark scheme would continue to be used if it is configured. Whereas today IPv6 labeling is only supported locally, the new code would support labeling remote systems as well. Systems that use CONFIG_SECURITY_SMACK_NETFILTER should be unaffected for local use. The host address labeling scheme would be retained, so any system configured to use IPv6 externally shouldn't see a difference. Systems that don't use the option should also work the same as they do today. Are there any users of Smack that use IPv6 but do not use CONFIG_SECURITY_SMACK_NETFILTER? Does anyone have, know of or imagine a use case where CALIPSO labeling would not be a viable replacement for the hackish "port labeling"? Thank you.