From: Mr Dash Four <mr.dash.four@googlemail.com>
To: Jan Engelhardt <jengelh@medozas.de>
Cc: Eric Paris <eparis@parisplace.org>,
netfilter@vger.kernel.org, sds@tycho.nsa.gov
Subject: Re: decipher the secmark number from nf_conntrack/ip_conntrack
Date: Thu, 23 Sep 2010 21:05:18 +0100 [thread overview]
Message-ID: <4C9BB2FE.4040201@googlemail.com> (raw)
In-Reply-To: <alpine.LNX.2.01.1009232148010.18921@obet.zrqbmnf.qr>
>> What happens to the new /nf(s)_conntrack
>>
>
> If anything, secmark=x be removed. Abusing procfs is deprecated.
> No userspace program depends on it.
>
Sorry, but I've never suggested that useless number be kept in any shape
or form anywhere (please read my posts on this very thread)!
There was a patch from Eric (I think about 2 days ago) showing
secmark=<selctx> in the output of nfs_conntrack and I assumed that will
be adopted. Is that no longer the case and if so why?
>
>> and iptables -L?
>>
>
> As was said earlier (by Eric?), the secmark/u32 value is useless and
> that secname (aka. selctx) should only ever be used. That is
> already the case with x_tables.
>
I've never suggested that the u32 was ever useful (it was actually you,
who asked me to devise a patch translating it into the actual text when
I suggested that this number is pretty useless, remember?).
Again, I assume that when I use "cat /proc/net/nf(s)_conntrack" I would
be able to see the proper translation of the SELinux context for all
connections and not that useless number (the whole reason for me
starting this thread). I think I've made myself perfectly clear on this.
next prev parent reply other threads:[~2010-09-23 20:05 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-09-19 23:04 decipher the secmark number from nf_conntrack/ip_conntrack Mr Dash Four
2010-09-20 0:48 ` Jan Engelhardt
2010-09-20 10:41 ` Mr Dash Four
2010-09-20 12:23 ` Jan Engelhardt
2010-09-20 12:42 ` Mr Dash Four
2010-09-20 18:15 ` Mr Dash Four
2010-09-20 21:49 ` Tom Eastep
2010-09-20 23:26 ` Jan Engelhardt
2010-09-20 23:55 ` Tom Eastep
2010-09-21 9:59 ` Mr Dash Four
2010-09-21 20:13 ` Mr Dash Four
2010-09-21 20:26 ` Eric Paris
2010-09-21 21:00 ` Eric Paris
2010-09-21 22:38 ` Mr Dash Four
2010-09-21 22:42 ` Jan Engelhardt
2010-09-21 22:51 ` Mr Dash Four
2010-09-21 23:10 ` Eric Paris
2010-09-21 23:35 ` Jan Engelhardt
2010-09-23 18:39 ` Eric Paris
2010-09-23 18:49 ` Jan Engelhardt
2010-09-23 18:52 ` Eric Paris
2010-09-23 18:57 ` Jan Engelhardt
2010-09-23 18:58 ` Eric Paris
2010-09-23 19:20 ` Mr Dash Four
2010-09-23 19:51 ` Jan Engelhardt
2010-09-23 20:05 ` Mr Dash Four [this message]
2010-09-23 20:18 ` Mr Dash Four
2010-09-23 20:34 ` Eric Paris
2010-09-23 20:38 ` Mr Dash Four
2010-09-23 20:53 ` Jan Engelhardt
2010-09-23 20:56 ` Mr Dash Four
2010-09-23 21:23 ` Jan Engelhardt
2010-09-23 21:38 ` Mr Dash Four
2010-09-23 22:12 ` Jan Engelhardt
2010-09-23 22:30 ` Mr Dash Four
2010-09-23 22:42 ` Eric Paris
2010-09-23 23:59 ` Jan Engelhardt
2010-09-24 0:24 ` Tom Eastep
2010-09-24 0:32 ` Mr Dash Four
2010-09-24 1:18 ` Jan Engelhardt
2010-09-24 0:27 ` Mr Dash Four
2010-09-23 20:42 ` Jan Engelhardt
2010-09-23 20:53 ` Mr Dash Four
2010-09-21 22:29 ` Mr Dash Four
2010-09-22 2:25 ` Tom Eastep
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4C9BB2FE.4040201@googlemail.com \
--to=mr.dash.four@googlemail.com \
--cc=eparis@parisplace.org \
--cc=jengelh@medozas.de \
--cc=netfilter@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.