I'm attempting to set the mark of a packet based on the PID it was originated from in the kernel. I came up with the following code as I was trying to work through things, and I had setup the rule on the OUTPUT chain: static unsigned int static unsigned int pidmark_tg(struct sk_buff *skb, const struct xt_action_param *par) { struct file *filp; if (skb->sk == NULL || skb->sk->sk_socket == NULL) { skb->mark = 0; printk("Socket not local, not setting mark?\n"); return XT_CONTINUE; } filp = skb->sk->sk_socket->file; if (filp == NULL) { printk("Filp null. :|\n"); return XT_CONTINUE; } read_lock(&filp->f_owner.lock); const struct cred *cred = filp->f_cred; printk("Uid: %d\n", from_kuid_munged(&init_user_ns, cred->fsuid)); struct task_struct *task; printk("Pid: %d\n", pid_nr(filp->f_owner.pid)); task = pid_task(filp->f_owner.pid, filp->f_owner.pid_type); printk("Task: %x\n", task); read_unlock(&filp->f_owner.lock); return XT_CONTINUE; } Unfortunately, looking at the log, pid always is set to 0, and pid_task always return null. Is there any way I can fetch the pid that created the skb from a netfilter target?