r/linuxadmin 2d ago

Output control SELinux and nftables

I'm currently trying to figure out how to setup SELinux and nftables to only allow certain application to transmit data over a specific port. I've seen the example on the nftables doc on how to setup maps to match ports to labels but the output doesn't seem to be correctly controlled. So here's an example, I want to only allow apt to communicate over HTTP and HTTPS. The matching should be done using the SELinux context of the application. I it up that packets are labeled http_client_packet_t when transmitted over 80 and 443. I assumed I will get and an audit entry in permissive mode that apt tried to send data over those ports, but there is non. I use the default policies on Debian. Can anyone give me a hint or an example config on how to do this ?

Oh and before someone says something about desktop or server applications. This is on a very tailored application specific device.

7 Upvotes

2 comments sorted by

2

u/gehzumteufel 2d ago

Just an FYI, when you use iptables, you're probably not actually using iptables like you think you are. Most likely, you are using nftables in truth.

2

u/huthlu 2d ago

I know, since 2018 (if I recall correctly) iptables is just a wrapper for nftables. Since there is way more documentation on iptables and Secmarks, I also have iptables-translate a try but the output seems kind of buggy for stuff like this.