1SHOREWALL-SECMARKS(5) [FIXME: manual] SHOREWALL-SECMARKS(5)
2
6 secmarks - Shorewall file
7
9 /etc/shorewall/secmarks
10
12 Important
13 Unlike rules in the shorewall-rules[1](5) file, evaluation of rules
14 in this file will continue after a match. So the final secmark for
15 each packet will be the one assigned by the LAST rule that matches.
16 The secmarks file is used to associate an SELinux context with packets.
18 It was added in Shorewall version 4.4.13.
19 The columns in the file are as follows.
21 SECMARK - {SAVE|RESTORE|context|COMMENT comment}
23 SAVE
25 If an SELinux context is associated with the packet, the
26 context is saved in the connection. Normally, the remaining
27 columns should be left blank.
28 RESTORE
30 If an SELinux context is not currently associated with the
31 packet, then the saved context (if any) is associated with the
32 packet. Normally, the remaining columns should be left blank.
33 context
35 An SELinux context.
36 COMMENT
38 The remainder of the line is treated as a comment which is
39 attached to subsequent rules until another COMMENT line is
40 found or until the end of the file is reached. To stop adding
41 comments to rules, use a line with only the word COMMENT.
42 CHAIN:STATE - {P|I|F|O|T}[:{N|I|NI|E|ER}]
44 This column determines the CHAIN where the SElinux context is to be
45 applied:
46 P - PREROUTING
47 I - INPUT
48 F - FORWARD
49 O - OUTPUT
50 T - POSTROUTING
51 It may be optionally followed by a colon and an indication of the
52 Netfilter connection state(s) at which the context is to be
53 applied:
54 :N - NEW connection
55 :I - INVALID connection
56 :NI - NEW or INVALID connection
57 :E - ESTABLISHED connection
58 :ER - ESTABLISHED or RELATED connection
59 SOURCE -
61 {-interface|[interface:]address-or-range[,address-or-range]...}[exclusion]
62 May be:
63 1. An interface name - matches traffic entering the firewall on
65 the specified interface. May not be used in classify rules or
66 in rules using the T in the CHAIN column.
67 2. A comma-separated list of host or network IP addresses or MAC
69 addresses.
70 3. An interface name followed by a colon (":") followed by a
72 comma-separated list of host or network IP addresses or MAC
73 addresses.
74 MAC addresses must be prefixed with "~" and use "-" as a separator.
76 Example: ~00-A0-C9-15-39-78
78 You may exclude certain hosts from the set already defined through
80 use of an exclusion (see shorewall-exclusion[2](5)).
81 Addresses may be specified using an ipset name preceded by '+'.
83 DEST -
85 {-|{interface|[interface:]address-or-range[,address-or-range]...}[exclusion]
86 May be:
87 1. An interface name. May not be used in the PREROUTING or INPUT
89 chains. The interface name may be optionally followed by a
90 colon (":") and an IP address list.
91 2. A comma-separated list of host or network IP addresses. The
93 list may include ip address ranges if your kernel and iptables
94 include iprange support.
95 You may exclude certain hosts from the set already defined through
97 use of an exclusion (see shorewall-exclusion[2](5)).
98 Addresses may be specified using an ipset name preceded by '+'.
100 PROTO -
102 {-|tcp:syn|ipp2p|ipp2p:udp|ipp2p:all|protocol-number|protocol-name|all}
103 Protocol - ipp2p requires ipp2p match support in your kernel and
104 iptables.
105 PORT(S) (Optional) -
107 [-|port-name-number-or-range[,port-name-number-or-range]...]
108 Destination Ports. A comma-separated list of Port names (from
109 services(5)), port numbers or port ranges; if the protocol is icmp,
110 this column is interpreted as the destination icmp-type(s). ICMP
111 types may be specified as a numeric type, a numberic type and code
112 separated by a slash (e.g., 3/4), or a typename. See
113 http://www.shorewall.net/configuration_file_basics.htm#ICMP.
114 If the protocol is ipp2p, this column is interpreted as an ipp2p
116 option without the leading "--" (example bit for bit-torrent). If
117 no PORT is given, ipp2p is assumed.
118 This column is ignored if PROTOCOL = all but must be entered if any
120 of the following field is supplied. In that case, it is suggested
121 that this field contain "-"
122 SOURCE PORT(S) (Optional) -
124 [-|port-name-number-or-range[,port-name-number-or-range]...]
125 Source port(s). If omitted, any source port is acceptable.
126 Specified as a comma-separated list of port names, port numbers or
127 port ranges.
128 USER (Optional) - [!][user-name-or-number][:group-name-or-number]
130 This column may only be non-empty if the SOURCE is the firewall
131 itself.
132 When this column is non-empty, the rule applies only if the program
134 generating the output is running under the effective user and/or
135 group specified (or is NOT running under that id if "!" is given).
136 Examples:
138 joe
140 program must be run by joe
141 :kids
143 program must be run by a member of the 'kids' group
144 !:kids
146 program must not be run by a member of the 'kids' group
147 MARK - [!]value[/mask][:C]
149 Defines a test on the existing packet or connection mark. The rule
150 will match only if the test returns true.
151 If you don't want to define a test but need to specify anything in
153 the following columns, place a "-" in this field.
154 !
156 Inverts the test (not equal)
157 value
159 Value of the packet or connection mark.
160 mask
162 A mask to be applied to the mark before testing.
163 :C
165 Designates a connection mark. If omitted, the packet mark's
166 value is tested.
167
169 Mark the first incoming packet of a connection on the loopback
170 interface and destined for address 127.0.0.1 and tcp port 3306 with
171 context system_u:object_r:mysqld_t:s0 and save that context in the
172 conntrack table. On subsequent input packets in the connection, set the
173 context from the conntrack table.
174 /etc/shorewall/interfaces:
176 #ZONE INTERFACE BROADCAST OPTIONS
178 - lo - ignore
179 /etc/shorewall/secmarks:
181 #SECMARK CHAIN: SOURCE DEST PROTO DEST SOURCE USER/ MARK
183 # STATE PORT(S) PORT(S) GROUP
184 system_u:object_r:mysqld_packet_t:s0 I:N lo 127.0.0.1 tcp 3306
185 SAVE I:N lo 127.0.0.1 tcp 3306
186 RESTORE I:ER
187
189 /etc/shorewall/secmarks
190
192 http://james-morris.livejournal.com/11010.html
193 shorewall(8), shorewall-accounting(5), shorewall-actions(5),
195 shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
196 shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
197 shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
198 shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
199 shorewall-route_rules(5), shorewall-routestopped(5),
200 shorewall-rules(5), shorewall.conf(5), shorewall-tcclasses(5),
201 shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5),
202 shorewall-tunnels(5), shorewall-zones(5)
203
205 1. shorewall-rules
206 http://www.shorewall.net/manpages/shorewall-rules.html
207 2. shorewall-exclusion
209 http://www.shorewall.net/manpages/shorewall-exclusion.html
210[FIXME: source] 09/16/2011 SHOREWALL-SECMARKS(5)