path: root/extensions/
diff options
authorDaniel Borkmann <>2013-12-23 18:46:29 +0100
committerPablo Neira Ayuso <>2014-01-04 15:45:34 +0100
commit6465867eb48506687872b838b1ddfee61d1a0aeb (patch)
treec1f4b3f6410bb04461dd7dad76bea3b6f6c7678f /extensions/
parent3cefc136d13f426fd68808ddfd39ada0c90f23db (diff)
iptables: add libxt_cgroup frontend
This patch adds the user space extension/frontend for process matching based on cgroups from the kernel patch entitled "netfilter: xtables: lightweight process control group matching". Signed-off-by: Daniel Borkmann <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'extensions/')
1 files changed, 15 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 00000000..456a0311
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,15 @@
+[\fB!\fP] \fB\-\-cgroup\fP \fIfwid\fP
+Match corresponding cgroup for this packet.
+Can be used to assign particular firewall policies for aggregated
+task/jobs on the system. This allows for more fine-grained firewall
+policies that only match for a subset of the system's processes.
+fwid is the maker set through the net_cls cgroup's id.
+iptables \-A OUTPUT \-p tcp \-\-sport 80 \-m cgroup ! \-\-cgroup 1
+\-j DROP
+Available since Linux 3.14.