Messages in this thread | | | From | Tilman Baumann <> | Subject | Re: SMACK netfilter smacklabel socket match | Date | Thu, 25 Sep 2008 22:32:02 +0200 |
| |
Am 25.09.2008 um 21:57 schrieb Paul Moore: >> >> What i do with this match is just setting some CONNMARK and >> respectively FWMARKS to make crazy routing rules for different kinds >> (marked processes) >> of my outgoing traffic based on them. > > I think I understand you goal now, essentially you want to route > traffic > based on the security label of the sender, yes? There was some brief > talk about this at the SELinux Developer's Summit this year at OLS. > Unfortunately, it was just a casual conversation and I haven't seen > any > patches since then implementing security label based routing.
Wow, now it strikes me that i was running around blind all the time. SECMARK is a target not a match. I always thought i would implementing much the same thing.
I guess there would be in fact currently not way to set a MARK or CONNMAK based on a SECMARK. Most of the *MARK targets have a --restore-mark option to restore a mark into the packet mark. But since the SECMARK is not numeric/bitmask there is nothing to restore. They however can do the same in regard do CONNSECMARK and SECMARK but which would not help in this case. A secmark netfilter _match_ could do the trick here.
Well here is how i did this, maybe something like this is the way to go for SELinux (or LSM in general) too.
I'm surprised that i have not realized this little detail before. :-/
Regards Tilman
| |