When I list my connections with 'cat /proc/net/nf_conntrack' I get the SELinux
context secmark as a number, like secmark=XXX.
Is there a way I could map that number to the name of the actual context when I
set it up originally with the --selctx option in iptables? If that is not
possible do you plan to include such feature in the upcoming versions of
netfilter?
Apart from SMACK, I don't think the kernel has knowledge about any names
of sorts, especially since SELinux labels seem to be able to
be longer than 8 chars.
So if anything, it would be done so in conntrack-tools which you should
be using over /proc anyway.
Is there any way I could do this with conntrack-tools? The only option I
could see on conntrack (the executable) is by using a filter and
specifying -c or --secmark (a number) which isn't what I am after!
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
