View source for Secmark

''secmark'' objects add netfilter [https://selinuxproject.org/page/NB_Networking#SECMARK SECMARK] labels to a ruleset, for use with [https://github.com/SELinuxProject SELinux] or other [https://en.wikipedia.org/wiki/Linux_Security_Modules Linux Security Modules]. At least [https://kernelnewbies.org/Linux_4.20 Linux kernel 4.20] and [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3] are required for ''secmark'' object support.

= Using ''secmark'' in rules =

The following ruleset defines an ''sshtag'' ''secmark'' object and uses it to set SECMARK on packets to port tcp/22 (ssh):

<source>
table inet secmark_rule_demo {

    secmark sshtag { "system_u:object_r:ssh_server_packet_t:s0" }

    chain IN {
        type filter hook input priority filter;

        tcp dport 22 meta secmark set "sshtag"
    }
}
</source>

= Using ''secmark'' in maps =

You can also use ''secmark'' in maps:

<source>
table inet secmark_map_demo {

    secmark sshtag { "system_u:object_r:ssh_server_packet_t:s0" }

    map secmapping {
        type inet_service : secmark
        elements = {
            22 : "sshtag",
        }
    }

    chain IN {
        type filter hook input priority filter;

        meta secmark set tcp dport map @secmapping
    }
}
</source>

= See Also =
* [http://git.netfilter.org/nftables/tree/files/examples/secmark.nft secmark.nft] example distributed with nftables source