On Monday 2010-09-20 12:41, Mr Dash Four wrote: > >>>When I list my connections with 'cat /proc/net/nf_conntrack' I get >>>the SELinux context secmark as a number, like secmark=XXX. >>> >>>Is there a way I could map that number to the name of the actual >>>context when I set it up originally with the --selctx option in >>>iptables? If that is not possible do you plan to include such feature >>>in the upcoming versions of netfilter? >>> >> >>Apart from SMACK, I don't think the kernel has knowledge about any >>names of sorts, especially since SELinux labels seem to be able to be >>longer than 8 chars. >> >>So if anything, it would be done so in conntrack-tools which you >>should be using over /proc anyway. > >Is there any way I could do this with conntrack-tools? The only option >I could see on conntrack (the executable) is by using a filter and >specifying -c or --secmark (a number) which isn't what I am after! Basically `conntrack -L`. You just need to write the patch that does the secmark->name translation. :-) -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
