For those not on the main SELinux list (or netdev or netfilter-devel), I've just posted an RFC and patches for a new scheme for per-packet network controls. See: http://thread.gmane.org/gmane.linux.network/34927/focus=34927 http://people.redhat.com/jmorris/selinux/secmark/ - James -- James Morris <jmorris at namei.org>