I've been thinking about this over the weekend and realized a few things ... I realized I made a mistake here: we should check to see if the skb has a socket associated with it and if it does get the peer_sid from there instead. We should probably have different permissions for the interface and node cases. Take the example of an admin who is only interested in enforcing interface controls and not node controls. They would most likely write the following policy rule to nullify the ...