[PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection

[PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection

[Christian Göttsche]

Labeling established and related packets requires the secmark to be stored in the connection.
Add the ability to store and retrieve secmarks like:

    ...
    chain input {
        ...

        # label new incoming packets
        ct state new meta secmark set tcp dport map @secmapping_in

        # add label to connection
        ct state new ct secmark set meta secmark

        # set label for est/rel packets from connection
        ct state established,related meta secmark set ct secmark

        ...
    }
    ...
    chain output {
        ...

        # label new outgoing packets
        ct state new meta secmark set tcp dport map @secmapping_out

        # add label to connection
        ct state new ct secmark set meta secmark

        # set label for est/rel packets from connection
        ct state established,related meta secmark set ct secmark

        ...
        }
    ...

This patch also disallow constant value on the right hand side.

    # nft add rule x y meta secmark 12
    Error: Cannot be used with right hand side constant value
    add rule x y meta secmark 12
                 ~~~~~~~~~~~~ ^^
    # nft add rule x y ct secmark 12
    Error: Cannot be used with right hand side constant value
    add rule x y ct secmark 12
                 ~~~~~~~~~~ ^^
    # nft add rule x y ct secmark set 12
    Error: ct secmark must not be set to constant value
    add rule x y ct secmark set 12
                 ^^^^^^^^^^^^^^^^^

This patch improves 3bc84e5c1fdd ("src: add support for setting secmark").

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
v2: - incorporate changes suggested by Pablo Neira Ayuso
    - invalidate setting ct secmark to a constant value, like:
        ct secmark set 12
      Note:
      statements setting the meta secmark, like
        meta secmark set 12
      must accept constant values, cause the secmark object identifier
      is a string
        meta secmark set "icmp_client"
      12 is probably not a used secmark object identifier, so it will
      fail:
        nft add rule inet filter input meta secmark set 12
        Error: Could not process rule: No such file or directory
        add rule inet filter input meta secmark set 12
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

 src/ct.c           |  2 ++
 src/evaluate.c     | 24 ++++++++++++++++++++++--
 src/meta.c         |  2 ++
 src/parser_bison.y | 14 +++++++++++---
 4 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/src/ct.c b/src/ct.c
index ed458e6b..9e6a8351 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -299,6 +299,8 @@ const struct ct_template ct_templates[__NFT_CT_MAX] = {
 					      BYTEORDER_BIG_ENDIAN, 128),
 	[NFT_CT_DST_IP6]	= CT_TEMPLATE("ip6 daddr", &ip6addr_type,
 					      BYTEORDER_BIG_ENDIAN, 128),
+	[NFT_CT_SECMARK]	= CT_TEMPLATE("secmark", &integer_type,
+					      BYTEORDER_HOST_ENDIAN, 32),
 };
 
 static void ct_print(enum nft_ct_keys key, int8_t dir, uint8_t nfproto,
diff --git a/src/evaluate.c b/src/evaluate.c
index e54eaf1a..a865902c 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1784,6 +1784,18 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
 					 left->dtype->desc,
 					 right->dtype->desc);
 
+	/*
+	 * Statements like 'ct secmark 12' are parsed as relational,
+	 * disallow constant value on the right hand side.
+	 */
+	if (((left->etype == EXPR_META &&
+	      left->meta.key == NFT_META_SECMARK) ||
+	     (left->etype == EXPR_CT &&
+	      left->ct.key == NFT_CT_SECMARK)) &&
+	    right->flags & EXPR_F_CONSTANT)
+		return expr_binary_error(ctx->msgs, right, left,
+					 "Cannot be used with right hand side constant value");
+
 	switch (rel->op) {
 	case OP_EQ:
 	case OP_IMPLICIT:
@@ -2319,11 +2331,19 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
 
 static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt)
 {
-	return stmt_evaluate_arg(ctx, stmt,
+	if (stmt_evaluate_arg(ctx, stmt,
 				 stmt->ct.tmpl->dtype,
 				 stmt->ct.tmpl->len,
 				 stmt->ct.tmpl->byteorder,
-				 &stmt->ct.expr);
+				 &stmt->ct.expr) < 0)
+		return -1;
+
+	if (stmt->ct.key == NFT_CT_SECMARK &&
+	    expr_is_constant(stmt->ct.expr))
+		return stmt_error(ctx, stmt,
+				  "ct secmark must not be set to constant value");
+
+	return 0;
 }
 
 static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx,
diff --git a/src/meta.c b/src/meta.c
index 69a897a9..796d8e94 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -698,6 +698,8 @@ const struct meta_template meta_templates[] = {
 	[NFT_META_TIME_HOUR]	= META_TEMPLATE("hour", &hour_type,
 						4 * BITS_PER_BYTE,
 						BYTEORDER_HOST_ENDIAN),
+	[NFT_META_SECMARK]	= META_TEMPLATE("secmark", &integer_type,
+						32, BYTEORDER_HOST_ENDIAN),
 };
 
 static bool meta_key_is_unqualified(enum nft_meta_keys key)
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 631b7d68..707f4671 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -4190,9 +4190,16 @@ meta_stmt		:	META	meta_key	SET	stmt_expr
 			{
 				switch ($2) {
 				case NFT_META_SECMARK:
-					$$ = objref_stmt_alloc(&@$);
-					$$->objref.type = NFT_OBJECT_SECMARK;
-					$$->objref.expr = $4;
+					switch ($4->etype) {
+					case EXPR_CT:
+						$$ = meta_stmt_alloc(&@$, $2, $4);
+						break;
+					default:
+						$$ = objref_stmt_alloc(&@$);
+						$$->objref.type = NFT_OBJECT_SECMARK;
+						$$->objref.expr = $4;
+						break;
+					}
 					break;
 				default:
 					$$ = meta_stmt_alloc(&@$, $2, $4);
@@ -4388,6 +4395,7 @@ ct_key			:	L3PROTOCOL	{ $$ = NFT_CT_L3PROTOCOL; }
 			|	PROTO_DST	{ $$ = NFT_CT_PROTO_DST; }
 			|	LABEL		{ $$ = NFT_CT_LABELS; }
 			|	EVENT		{ $$ = NFT_CT_EVENTMASK; }
+			|	SECMARK		{ $$ = NFT_CT_SECMARK; }
 			|	ct_key_dir_optional
 			;
 
-- 
2.24.0

[PATCH nftables v2 2/2] files: add example secmark config

[Christian Göttsche]

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
v2: add note about SELinux requirements for this example

 files/examples/Makefile.am |  1 +
 files/examples/secmark.nft | 87 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 88 insertions(+)
 create mode 100755 files/examples/secmark.nft

diff --git a/files/examples/Makefile.am b/files/examples/Makefile.am
index c40e041e..b29e9f61 100644
--- a/files/examples/Makefile.am
+++ b/files/examples/Makefile.am
@@ -1,4 +1,5 @@
 pkgdocdir = ${docdir}/examples
 dist_pkgdoc_SCRIPTS = ct_helpers.nft \
 		load_balancing.nft \
+		secmark.nft \
 		sets_and_maps.nft
diff --git a/files/examples/secmark.nft b/files/examples/secmark.nft
new file mode 100755
index 00000000..16f9a368
--- /dev/null
+++ b/files/examples/secmark.nft
@@ -0,0 +1,87 @@
+#!/usr/sbin/nft -f
+
+# This example file shows how to use secmark labels with the nftables framework.
+# This script is meant to be loaded with `nft -f <file>`
+# You require linux kernel >= 4.20 and nft >= 0.9.3
+# This example is SELinux based, for the secmark objects you require
+# SELinux enabled and a SELinux policy defining the stated contexts
+# For up-to-date information please visit https://wiki.nftables.org
+
+
+flush ruleset
+
+table inet filter {
+	secmark ssh_server {
+		"system_u:object_r:ssh_server_packet_t:s0"
+	}
+
+	secmark dns_client {
+		"system_u:object_r:dns_client_packet_t:s0"
+	}
+
+	secmark http_client {
+		"system_u:object_r:http_client_packet_t:s0"
+	}
+
+	secmark https_client {
+		"system_u:object_r:http_client_packet_t:s0"
+	}
+
+	secmark ntp_client {
+		"system_u:object_r:ntp_client_packet_t:s0"
+	}
+
+	secmark icmp_client {
+		"system_u:object_r:icmp_client_packet_t:s0"
+	}
+
+	secmark icmp_server {
+		"system_u:object_r:icmp_server_packet_t:s0"
+	}
+
+	secmark ssh_client {
+		"system_u:object_r:ssh_client_packet_t:s0"
+	}
+
+	secmark git_client {
+		"system_u:object_r:git_client_packet_t:s0"
+	}
+
+	map secmapping_in {
+		type inet_service : secmark
+		elements = { 22 : "ssh_server" }
+	}
+
+	map secmapping_out {
+		type inet_service : secmark
+		elements = { 22 : "ssh_client", 53 : "dns_client", 80 : "http_client", 123 : "ntp_client", 443 : "http_client", 9418 : "git_client" }
+	}
+
+	chain input {
+		type filter hook input priority 0;
+
+		# label new incoming packets and add to connection
+		ct state new meta secmark set tcp dport map @secmapping_in
+		ct state new meta secmark set udp dport map @secmapping_in
+		ct state new ip protocol icmp meta secmark set "icmp_server"
+		ct state new ip6 nexthdr icmpv6 meta secmark set "icmp_server"
+		ct state new ct secmark set meta secmark
+
+		# set label for est/rel packets from connection
+		ct state established,related meta secmark set ct secmark
+	}
+
+	chain output {
+		type filter hook output priority 0;
+
+		# label new outgoing packets and add to connection
+		ct state new meta secmark set tcp dport map @secmapping_out
+		ct state new meta secmark set udp dport map @secmapping_out
+		ct state new ip protocol icmp meta secmark set "icmp_client"
+		ct state new ip6 nexthdr icmpv6 meta secmark set "icmp_client"
+		ct state new ct secmark set meta secmark
+
+		# set label for est/rel packets from connection
+		ct state established,related meta secmark set ct secmark
+	}
+}
-- 
2.24.0

Re: [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection

[Pablo Neira Ayuso]

Hi Christian,

On Sat, Nov 23, 2019 at 05:22:39PM +0100, Christian Göttsche wrote:
[...]
> v2: - incorporate changes suggested by Pablo Neira Ayuso
>     - invalidate setting ct secmark to a constant value, like:
>         ct secmark set 12
>       Note:
>       statements setting the meta secmark, like
>         meta secmark set 12
>       must accept constant values, cause the secmark object identifier
>       is a string
>         meta secmark set "icmp_client"

This is represented as a object reference statement from the parser.

It should be safe to do the same check from stmt_evaluate_meta() that
this patch does for stmt_evaluate_ct().

>       12 is probably not a used secmark object identifier, so it will
>       fail:
>         nft add rule inet filter input meta secmark set 12
>         Error: Could not process rule: No such file or directory
>         add rule inet filter input meta secmark set 12
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>  src/ct.c           |  2 ++
>  src/evaluate.c     | 24 ++++++++++++++++++++++--
>  src/meta.c         |  2 ++
>  src/parser_bison.y | 14 +++++++++++---
>  4 files changed, 37 insertions(+), 5 deletions(-)
> 
> diff --git a/src/ct.c b/src/ct.c
> index ed458e6b..9e6a8351 100644
> --- a/src/ct.c
> +++ b/src/ct.c
> @@ -299,6 +299,8 @@ const struct ct_template ct_templates[__NFT_CT_MAX] = {
>  					      BYTEORDER_BIG_ENDIAN, 128),
>  	[NFT_CT_DST_IP6]	= CT_TEMPLATE("ip6 daddr", &ip6addr_type,
>  					      BYTEORDER_BIG_ENDIAN, 128),
> +	[NFT_CT_SECMARK]	= CT_TEMPLATE("secmark", &integer_type,
> +					      BYTEORDER_HOST_ENDIAN, 32),
>  };
>  
>  static void ct_print(enum nft_ct_keys key, int8_t dir, uint8_t nfproto,
> diff --git a/src/evaluate.c b/src/evaluate.c
> index e54eaf1a..a865902c 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -1784,6 +1784,18 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
>  					 left->dtype->desc,
>  					 right->dtype->desc);
>  
> +	/*
> +	 * Statements like 'ct secmark 12' are parsed as relational,
> +	 * disallow constant value on the right hand side.
> +	 */
> +	if (((left->etype == EXPR_META &&
> +	      left->meta.key == NFT_META_SECMARK) ||
> +	     (left->etype == EXPR_CT &&
> +	      left->ct.key == NFT_CT_SECMARK)) &&
> +	    right->flags & EXPR_F_CONSTANT)
> +		return expr_binary_error(ctx->msgs, right, left,
> +					 "Cannot be used with right hand side constant value");
> +
>  	switch (rel->op) {
>  	case OP_EQ:
>  	case OP_IMPLICIT:
> @@ -2319,11 +2331,19 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
>  
>  static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt)
>  {
> -	return stmt_evaluate_arg(ctx, stmt,
> +	if (stmt_evaluate_arg(ctx, stmt,
>  				 stmt->ct.tmpl->dtype,
>  				 stmt->ct.tmpl->len,
>  				 stmt->ct.tmpl->byteorder,
> -				 &stmt->ct.expr);
> +				 &stmt->ct.expr) < 0)
> +		return -1;
> +
> +	if (stmt->ct.key == NFT_CT_SECMARK &&
> +	    expr_is_constant(stmt->ct.expr))
> +		return stmt_error(ctx, stmt,
> +				  "ct secmark must not be set to constant value");
> +
> +	return 0;
>  }
>  
>  static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx,
> diff --git a/src/meta.c b/src/meta.c
> index 69a897a9..796d8e94 100644
> --- a/src/meta.c
> +++ b/src/meta.c
> @@ -698,6 +698,8 @@ const struct meta_template meta_templates[] = {
>  	[NFT_META_TIME_HOUR]	= META_TEMPLATE("hour", &hour_type,
>  						4 * BITS_PER_BYTE,
>  						BYTEORDER_HOST_ENDIAN),
> +	[NFT_META_SECMARK]	= META_TEMPLATE("secmark", &integer_type,
> +						32, BYTEORDER_HOST_ENDIAN),
>  };
>  
>  static bool meta_key_is_unqualified(enum nft_meta_keys key)
> diff --git a/src/parser_bison.y b/src/parser_bison.y
> index 631b7d68..707f4671 100644
> --- a/src/parser_bison.y
> +++ b/src/parser_bison.y
> @@ -4190,9 +4190,16 @@ meta_stmt		:	META	meta_key	SET	stmt_expr
>  			{
>  				switch ($2) {
>  				case NFT_META_SECMARK:
> -					$$ = objref_stmt_alloc(&@$);
> -					$$->objref.type = NFT_OBJECT_SECMARK;
> -					$$->objref.expr = $4;
> +					switch ($4->etype) {
> +					case EXPR_CT:
> +						$$ = meta_stmt_alloc(&@$, $2, $4);
> +						break;
> +					default:
> +						$$ = objref_stmt_alloc(&@$);
> +						$$->objref.type = NFT_OBJECT_SECMARK;
> +						$$->objref.expr = $4;
> +						break;
> +					}
>  					break;
>  				default:
>  					$$ = meta_stmt_alloc(&@$, $2, $4);
> @@ -4388,6 +4395,7 @@ ct_key			:	L3PROTOCOL	{ $$ = NFT_CT_L3PROTOCOL; }
>  			|	PROTO_DST	{ $$ = NFT_CT_PROTO_DST; }
>  			|	LABEL		{ $$ = NFT_CT_LABELS; }
>  			|	EVENT		{ $$ = NFT_CT_EVENTMASK; }
> +			|	SECMARK		{ $$ = NFT_CT_SECMARK; }
>  			|	ct_key_dir_optional
>  			;
>  
> -- 
> 2.24.0
> 

Re: [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection

[Pablo Neira Ayuso]

On Mon, Nov 25, 2019 at 01:10:12PM +0100, Pablo Neira Ayuso wrote:
> Hi Christian,
> 
> On Sat, Nov 23, 2019 at 05:22:39PM +0100, Christian Göttsche wrote:
> [...]
> > v2: - incorporate changes suggested by Pablo Neira Ayuso
> >     - invalidate setting ct secmark to a constant value, like:
> >         ct secmark set 12
> >       Note:
> >       statements setting the meta secmark, like
> >         meta secmark set 12
> >       must accept constant values, cause the secmark object identifier
> >       is a string
> >         meta secmark set "icmp_client"
> 
> This is represented as a object reference statement from the parser.
> 
> It should be safe to do the same check from stmt_evaluate_meta() that
> this patch does for stmt_evaluate_ct().

Oh, now I understand what you describe, your patch looks good indeed.

> >       12 is probably not a used secmark object identifier, so it will
> >       fail:
> >         nft add rule inet filter input meta secmark set 12
> >         Error: Could not process rule: No such file or directory
> >         add rule inet filter input meta secmark set 12
> >         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> >  src/ct.c           |  2 ++
> >  src/evaluate.c     | 24 ++++++++++++++++++++++--
> >  src/meta.c         |  2 ++
> >  src/parser_bison.y | 14 +++++++++++---
> >  4 files changed, 37 insertions(+), 5 deletions(-)
> > 
> > diff --git a/src/ct.c b/src/ct.c
> > index ed458e6b..9e6a8351 100644
> > --- a/src/ct.c
> > +++ b/src/ct.c
> > @@ -299,6 +299,8 @@ const struct ct_template ct_templates[__NFT_CT_MAX] = {
> >  					      BYTEORDER_BIG_ENDIAN, 128),
> >  	[NFT_CT_DST_IP6]	= CT_TEMPLATE("ip6 daddr", &ip6addr_type,
> >  					      BYTEORDER_BIG_ENDIAN, 128),
> > +	[NFT_CT_SECMARK]	= CT_TEMPLATE("secmark", &integer_type,
> > +					      BYTEORDER_HOST_ENDIAN, 32),
> >  };
> >  
> >  static void ct_print(enum nft_ct_keys key, int8_t dir, uint8_t nfproto,
> > diff --git a/src/evaluate.c b/src/evaluate.c
> > index e54eaf1a..a865902c 100644
> > --- a/src/evaluate.c
> > +++ b/src/evaluate.c
> > @@ -1784,6 +1784,18 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
> >  					 left->dtype->desc,
> >  					 right->dtype->desc);
> >  
> > +	/*
> > +	 * Statements like 'ct secmark 12' are parsed as relational,
> > +	 * disallow constant value on the right hand side.
> > +	 */
> > +	if (((left->etype == EXPR_META &&
> > +	      left->meta.key == NFT_META_SECMARK) ||
> > +	     (left->etype == EXPR_CT &&
> > +	      left->ct.key == NFT_CT_SECMARK)) &&
> > +	    right->flags & EXPR_F_CONSTANT)
> > +		return expr_binary_error(ctx->msgs, right, left,
> > +					 "Cannot be used with right hand side constant value");
> > +
> >  	switch (rel->op) {
> >  	case OP_EQ:
> >  	case OP_IMPLICIT:
> > @@ -2319,11 +2331,19 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
> >  
> >  static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt)
> >  {
> > -	return stmt_evaluate_arg(ctx, stmt,
> > +	if (stmt_evaluate_arg(ctx, stmt,
> >  				 stmt->ct.tmpl->dtype,
> >  				 stmt->ct.tmpl->len,
> >  				 stmt->ct.tmpl->byteorder,
> > -				 &stmt->ct.expr);
> > +				 &stmt->ct.expr) < 0)
> > +		return -1;
> > +
> > +	if (stmt->ct.key == NFT_CT_SECMARK &&
> > +	    expr_is_constant(stmt->ct.expr))
> > +		return stmt_error(ctx, stmt,
> > +				  "ct secmark must not be set to constant value");
> > +
> > +	return 0;
> >  }
> >  
> >  static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx,
> > diff --git a/src/meta.c b/src/meta.c
> > index 69a897a9..796d8e94 100644
> > --- a/src/meta.c
> > +++ b/src/meta.c
> > @@ -698,6 +698,8 @@ const struct meta_template meta_templates[] = {
> >  	[NFT_META_TIME_HOUR]	= META_TEMPLATE("hour", &hour_type,
> >  						4 * BITS_PER_BYTE,
> >  						BYTEORDER_HOST_ENDIAN),
> > +	[NFT_META_SECMARK]	= META_TEMPLATE("secmark", &integer_type,
> > +						32, BYTEORDER_HOST_ENDIAN),
> >  };
> >  
> >  static bool meta_key_is_unqualified(enum nft_meta_keys key)
> > diff --git a/src/parser_bison.y b/src/parser_bison.y
> > index 631b7d68..707f4671 100644
> > --- a/src/parser_bison.y
> > +++ b/src/parser_bison.y
> > @@ -4190,9 +4190,16 @@ meta_stmt		:	META	meta_key	SET	stmt_expr
> >  			{
> >  				switch ($2) {
> >  				case NFT_META_SECMARK:
> > -					$$ = objref_stmt_alloc(&@$);
> > -					$$->objref.type = NFT_OBJECT_SECMARK;
> > -					$$->objref.expr = $4;
> > +					switch ($4->etype) {
> > +					case EXPR_CT:
> > +						$$ = meta_stmt_alloc(&@$, $2, $4);
> > +						break;
> > +					default:
> > +						$$ = objref_stmt_alloc(&@$);
> > +						$$->objref.type = NFT_OBJECT_SECMARK;
> > +						$$->objref.expr = $4;
> > +						break;
> > +					}
> >  					break;
> >  				default:
> >  					$$ = meta_stmt_alloc(&@$, $2, $4);
> > @@ -4388,6 +4395,7 @@ ct_key			:	L3PROTOCOL	{ $$ = NFT_CT_L3PROTOCOL; }
> >  			|	PROTO_DST	{ $$ = NFT_CT_PROTO_DST; }
> >  			|	LABEL		{ $$ = NFT_CT_LABELS; }
> >  			|	EVENT		{ $$ = NFT_CT_EVENTMASK; }
> > +			|	SECMARK		{ $$ = NFT_CT_SECMARK; }
> >  			|	ct_key_dir_optional
> >  			;
> >  
> > -- 
> > 2.24.0
> > 

Re: [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection

[Pablo Neira Ayuso]

On Sat, Nov 23, 2019 at 05:22:39PM +0100, Christian Göttsche wrote:
> Labeling established and related packets requires the secmark to be stored in the connection.
> Add the ability to store and retrieve secmarks like:
[...]

Applied, thanks.

Re: [PATCH nftables v2 2/2] files: add example secmark config

[Pablo Neira Ayuso]

Applied, thanks.