Safari 4 has this menu item called “Save As Web Application”. Using this option basically causes Safari to create a fork of some binaries (aka our entrypoint) and configs. Then when you run your My Space web application and it crashes and burns due to some miscoded flash it won’t take out the all important Google Reader web application.

The point here is that Safari already has some slick, easy to implement, infrastructure in-place that could really make MAC separation for browser sessions easy to use take advantage of… the other browsers should pick up on it.

I think you will agree traditional DNS is even a less reliable source for determining labels and making access decisions. If you think about it though the common use case is probably placing a intranet or “mission apps” in one security domain and the Internet in another security domain. So perhaps an enterprise could implement DNSSEC and place all non-signed domains in one “internet_website_t” and signed/DNSSEC, internal domains in “internal_website_t”.

Ignoring other issues like using a different server to resolve or even entering the IP address by hand, the DNS query resolves to an IP. So we’re back to labeling based on IP.

Maybe we could use SSL certs to determine the domain for the individual chrome processes. Let’s assume a simple case: Chrome is given a list of certs for servers that should run “internal_website_t”. When the user requests a page Chrome establishes the connection, does the handshake and key exchange and then setexecon/fork/execs in “internal_website_t”. If there is no cert or the connection isn’t using ssl it ends in internet_website_t.