Fmyhr: Initial page, using examples from nftables 0.9.1 release notes.

2021-04-09T15:04:19Z

Initial page, using examples from nftables 0.9.1 release notes.

New page

''secmark'' objects add netfilter [https://selinuxproject.org/page/NB_Networking#SECMARK SECMARK] labels to a ruleset, for use with [https://github.com/SELinuxProject SELinux] or other [https://en.wikipedia.org/wiki/Linux_Security_Modules Linux Security Modules]. At least [https://kernelnewbies.org/Linux_4.20 Linux kernel 4.20] and [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3] are required for ''secmark'' object support.

= Using ''secmark'' in rules =

The following ruleset defines an ''sshtag'' ''secmark'' object and uses it to set SECMARK on packets to port tcp/22 (ssh):

<source>
table inet secmark_rule_demo {

secmark sshtag { "system_u:object_r:ssh_server_packet_t:s0" }

chain IN {
type filter hook input priority filter;

tcp dport 22 meta secmark set "sshtag"
}
}
</source>

= Using ''secmark'' in maps =

You can also use ''secmark'' in maps:

<source>
table inet secmark_map_demo {

secmark sshtag { "system_u:object_r:ssh_server_packet_t:s0" }

map secmapping {
type inet_service : secmark
elements = {
22 : "sshtag",
}
}

chain IN {
type filter hook input priority filter;

meta secmark set tcp dport map @secmapping
}
}
</source>

= See Also =
* [http://git.netfilter.org/nftables/tree/files/examples/secmark.nft secmark.nft] example distributed with nftables source

Secmark - Revision history

Fmyhr: Initial page, using examples from nftables 0.9.1 release notes.