cat /proc/net/nfs_conntrack
ipv4 2 udp 17 8 src=10.11.231.82 dst=10.11.255.156
sport=34095 dport=53 src=10.11.255.156 dst=10.11.231.82 sport=53
dport=34095 mark=0 secmark=system_u:object_r:unlabeled_t:s0 use=2
I think that rather than bloating ancient procfs files with more info,
the respective userspace tool should be augmented by secmark name
resolution instead. Then we would also not need change anything inside
the kernel, or its interfaces to userspace.
The point Eric made (and is a very good one) is that this number should
not be there - at all!
Who would make sense of that number?
This number is only (remotely) useful if somebody is parsing secmark=xxx
for simple <>0 checks - i.e. to find out whether there is a context
defined for that connection. I agree that there should be userspace
function for converting sids to text, but nfs_conntrack, in my view,
should contain the full context (so, in other words - we should have both).
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
