Re: decipher the secmark number from nf_conntrack/ip_conntrack

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




When I list my connections with 'cat /proc/net/nf_conntrack' I get the SELinux
context secmark as a number, like secmark=XXX.

Is there a way I could map that number to the name of the actual context when I
set it up originally with the --selctx option in iptables? If that is not
possible do you plan to include such feature in the upcoming versions of
netfilter?

Apart from SMACK, I don't think the kernel has knowledge about any names of sorts, especially since SELinux labels seem to be able to be longer than 8 chars.

So if anything, it would be done so in conntrack-tools which you should be using over /proc anyway.
Is there any way I could do this with conntrack-tools? The only option I could see on conntrack (the executable) is by using a filter and specifying -c or --secmark (a number) which isn't what I am after!
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux