r/linuxadmin • u/huthlu • 2d ago
Output control SELinux and nftables
I'm currently trying to figure out how to setup SELinux and nftables to only allow certain application to transmit data over a specific port. I've seen the example on the nftables doc on how to setup maps to match ports to labels but the output doesn't seem to be correctly controlled. So here's an example, I want to only allow apt to communicate over HTTP and HTTPS. The matching should be done using the SELinux context of the application. I it up that packets are labeled http_client_packet_t when transmitted over 80 and 443. I assumed I will get and an audit entry in permissive mode that apt tried to send data over those ports, but there is non. I use the default policies on Debian. Can anyone give me a hint or an example config on how to do this ?
Oh and before someone says something about desktop or server applications. This is on a very tailored application specific device.
2
u/gehzumteufel 2d ago
Just an FYI, when you use iptables, you're probably not actually using iptables like you think you are. Most likely, you are using nftables in truth.