On Thu, Mar 03, 2016 at 12:45:55AM +0530, Shivani Bhardwaj wrote: > Add translation for module owner to nftables. > Full translation of this match awaits the support for --socket-exists > option. > > Examples: > > $ sudo iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner > --uid-owner root -j ACCEPT > nft add rule ip nat OUTPUT tcp dport 80 skuid 0 counter accept > > $ sudo iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner > --gid-owner 0-10 -j ACCEPT > nft add rule ip nat OUTPUT tcp dport 80 skgid 0-10 counter accept > > $ sudo iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner ! > --uid-owner shivani -j ACCEPT > nft add rule ip nat OUTPUT tcp dport 80 skuid != 1000 counter accept
Applied, thanks Shivani. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
