1SHOREWALL-SECMARKS(5)           [FIXME: manual]          SHOREWALL-SECMARKS(5)
2
3
4

NAME

6       secmarks - Shorewall file
7

SYNOPSIS

9       /etc/shorewall/secmarks
10

DESCRIPTION

12           Important
13           Unlike rules in the shorewall-rules[1](5) file, evaluation of rules
14           in this file will continue after a match. So the final secmark for
15           each packet will be the one assigned by the LAST rule that matches.
16
17       The secmarks file is used to associate an SELinux context with packets.
18       It was added in Shorewall version 4.4.13.
19
20       The columns in the file are as follows.
21
22       SECMARK - {SAVE|RESTORE|context|COMMENT comment}
23
24           SAVE
25               If an SELinux context is associated with the packet, the
26               context is saved in the connection. Normally, the remaining
27               columns should be left blank.
28
29           RESTORE
30               If an SELinux context is not currently associated with the
31               packet, then the saved context (if any) is associated with the
32               packet. Normally, the remaining columns should be left blank.
33
34           context
35               An SELinux context.
36
37           COMMENT
38               The remainder of the line is treated as a comment which is
39               attached to subsequent rules until another COMMENT line is
40               found or until the end of the file is reached. To stop adding
41               comments to rules, use a line with only the word COMMENT.
42
43       CHAIN:STATE - {P|I|F|O|T}[:{N|I|NI|E|ER}]
44           This column determines the CHAIN where the SElinux context is to be
45           applied:
46               P - PREROUTING
47               I - INPUT
48               F - FORWARD
49               O - OUTPUT
50               T - POSTROUTING
51           It may be optionally followed by a colon and an indication of the
52           Netfilter connection state(s) at which the context is to be
53           applied:
54               :N - NEW connection
55               :I - INVALID connection
56               :NI - NEW or INVALID connection
57               :E - ESTABLISHED connection
58               :ER - ESTABLISHED or RELATED connection
59
60       SOURCE -
61       {-interface|[interface:]address-or-range[,address-or-range]...}[exclusion]
62           May be:
63
64            1. An interface name - matches traffic entering the firewall on
65               the specified interface. May not be used in classify rules or
66               in rules using the T in the CHAIN column.
67
68            2. A comma-separated list of host or network IP addresses or MAC
69               addresses.
70
71            3. An interface name followed by a colon (":") followed by a
72               comma-separated list of host or network IP addresses or MAC
73               addresses.
74
75           MAC addresses must be prefixed with "~" and use "-" as a separator.
76
77           Example: ~00-A0-C9-15-39-78
78
79           You may exclude certain hosts from the set already defined through
80           use of an exclusion (see shorewall-exclusion[2](5)).
81
82           Addresses may be specified using an ipset name preceded by '+'.
83
84       DEST -
85       {-|{interface|[interface:]address-or-range[,address-or-range]...}[exclusion]
86           May be:
87
88            1. An interface name. May not be used in the PREROUTING or INPUT
89               chains. The interface name may be optionally followed by a
90               colon (":") and an IP address list.
91
92            2. A comma-separated list of host or network IP addresses. The
93               list may include ip address ranges if your kernel and iptables
94               include iprange support.
95
96           You may exclude certain hosts from the set already defined through
97           use of an exclusion (see shorewall-exclusion[2](5)).
98
99           Addresses may be specified using an ipset name preceded by '+'.
100
101       PROTO -
102       {-|tcp:syn|ipp2p|ipp2p:udp|ipp2p:all|protocol-number|protocol-name|all}
103           Protocol - ipp2p requires ipp2p match support in your kernel and
104           iptables.
105
106       PORT(S) (Optional) -
107       [-|port-name-number-or-range[,port-name-number-or-range]...]
108           Destination Ports. A comma-separated list of Port names (from
109           services(5)), port numbers or port ranges; if the protocol is icmp,
110           this column is interpreted as the destination icmp-type(s). ICMP
111           types may be specified as a numeric type, a numberic type and code
112           separated by a slash (e.g., 3/4), or a typename. See
113           http://www.shorewall.net/configuration_file_basics.htm#ICMP.
114
115           If the protocol is ipp2p, this column is interpreted as an ipp2p
116           option without the leading "--" (example bit for bit-torrent). If
117           no PORT is given, ipp2p is assumed.
118
119           This column is ignored if PROTOCOL = all but must be entered if any
120           of the following field is supplied. In that case, it is suggested
121           that this field contain "-"
122
123       SOURCE PORT(S) (Optional) -
124       [-|port-name-number-or-range[,port-name-number-or-range]...]
125           Source port(s). If omitted, any source port is acceptable.
126           Specified as a comma-separated list of port names, port numbers or
127           port ranges.
128
129       USER (Optional) - [!][user-name-or-number][:group-name-or-number]
130           This column may only be non-empty if the SOURCE is the firewall
131           itself.
132
133           When this column is non-empty, the rule applies only if the program
134           generating the output is running under the effective user and/or
135           group specified (or is NOT running under that id if "!" is given).
136
137           Examples:
138
139           joe
140               program must be run by joe
141
142           :kids
143               program must be run by a member of the 'kids' group
144
145           !:kids
146               program must not be run by a member of the 'kids' group
147
148       MARK - [!]value[/mask][:C]
149           Defines a test on the existing packet or connection mark. The rule
150           will match only if the test returns true.
151
152           If you don't want to define a test but need to specify anything in
153           the following columns, place a "-" in this field.
154
155           !
156               Inverts the test (not equal)
157
158           value
159               Value of the packet or connection mark.
160
161           mask
162               A mask to be applied to the mark before testing.
163
164           :C
165               Designates a connection mark. If omitted, the packet mark's
166               value is tested.
167

EXAMPLE

169       Mark the first incoming packet of a connection on the loopback
170       interface and destined for address 127.0.0.1 and tcp port 3306 with
171       context system_u:object_r:mysqld_t:s0 and save that context in the
172       conntrack table. On subsequent input packets in the connection, set the
173       context from the conntrack table.
174
175       /etc/shorewall/interfaces:
176
177           #ZONE      INTERFACE      BROADCAST       OPTIONS
178           -          lo             -               ignore
179
180       /etc/shorewall/secmarks:
181
182           #SECMARK                              CHAIN:     SOURCE  DEST       PROTO   DEST       SOURCE      USER/     MARK
183           #                                     STATE                                 PORT(S)    PORT(S)     GROUP
184           system_u:object_r:mysqld_packet_t:s0  I:N        lo      127.0.0.1  tcp     3306
185           SAVE                                  I:N        lo      127.0.0.1  tcp     3306
186           RESTORE                               I:ER
187

FILES

189       /etc/shorewall/secmarks
190

SEE ALSO

192       http://james-morris.livejournal.com/11010.html
193
194       shorewall(8), shorewall-accounting(5), shorewall-actions(5),
195       shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
196       shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
197       shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
198       shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
199       shorewall-route_rules(5), shorewall-routestopped(5),
200       shorewall-rules(5), shorewall.conf(5), shorewall-tcclasses(5),
201       shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5),
202       shorewall-tunnels(5), shorewall-zones(5)
203

NOTES

205        1. shorewall-rules
206           http://www.shorewall.net/manpages/shorewall-rules.html
207
208        2. shorewall-exclusion
209           http://www.shorewall.net/manpages/shorewall-exclusion.html
210
211
212
213[FIXME: source]                   09/16/2011             SHOREWALL-SECMARKS(5)
Impressum