diff options
author | Topi Miettinen <toiwoton@gmail.com> | 2022-05-22 14:21:02 +0300 |
---|---|---|
committer | Topi Miettinen <topimiettinen@users.noreply.github.com> | 2022-06-08 16:12:25 +0000 |
commit | c0548df0a2f78f3422d77c77c2149d8a7f50d8f6 (patch) | |
tree | 4e363ae5071b1c60622f3f8e9ffa621bbeff3150 /man/org.freedesktop.systemd1.xml | |
parent | ab51fd9dbdc59f9a37acd8acaea3e9088d092bba (diff) | |
download | systemd-c0548df0a2f78f3422d77c77c2149d8a7f50d8f6.tar.gz |
core: firewall integration with ControlGroupNFTSet=
New directive `ControlGroupNFTSet=` provides a method for integrating services
into firewall rules with NFT sets.
Example:
```
table inet filter {
...
set timesyncd {
type cgroupsv2
}
chain ntp_output {
socket cgroupv2 != @timesyncd counter drop
accept
}
...
}
```
/etc/systemd/system/systemd-timesyncd.service.d/override.conf
```
[Service]
ControlGroupNFTSet=inet:filter:timesyncd
```
```
$ sudo nft list set inet filter timesyncd
table inet filter {
set timesyncd {
type cgroupsv2
elements = { "system.slice/systemd-timesyncd.service" }
}
}
```
Diffstat (limited to 'man/org.freedesktop.systemd1.xml')
-rw-r--r-- | man/org.freedesktop.systemd1.xml | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/man/org.freedesktop.systemd1.xml b/man/org.freedesktop.systemd1.xml index 7974833554..6625a74073 100644 --- a/man/org.freedesktop.systemd1.xml +++ b/man/org.freedesktop.systemd1.xml @@ -2599,6 +2599,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice { @org.freedesktop.DBus.Property.EmitsChangedSignal("false") readonly (bas) RestrictNetworkInterfaces = ...; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") + readonly a(iss) ControlGroupNFTSet = [...]; + @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly as Environment = ['...', ...]; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly a(sb) EnvironmentFiles = [...]; @@ -3170,6 +3172,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice { <!--property RestrictNetworkInterfaces is not documented!--> + <!--property ControlGroupNFTSet is not documented!--> + <!--property EnvironmentFiles is not documented!--> <!--property PassEnvironment is not documented!--> @@ -3750,6 +3754,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice { <variablelist class="dbus-property" generated="True" extra-ref="RestrictNetworkInterfaces"/> + <variablelist class="dbus-property" generated="True" extra-ref="ControlGroupNFTSet"/> + <variablelist class="dbus-property" generated="True" extra-ref="Environment"/> <variablelist class="dbus-property" generated="True" extra-ref="EnvironmentFiles"/> @@ -4487,6 +4493,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket { @org.freedesktop.DBus.Property.EmitsChangedSignal("false") readonly (bas) RestrictNetworkInterfaces = ...; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") + readonly a(iss) ControlGroupNFTSet = [...]; + @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly as Environment = ['...', ...]; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly a(sb) EnvironmentFiles = [...]; @@ -5082,6 +5090,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket { <!--property RestrictNetworkInterfaces is not documented!--> + <!--property ControlGroupNFTSet is not documented!--> + <!--property EnvironmentFiles is not documented!--> <!--property PassEnvironment is not documented!--> @@ -5656,6 +5666,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket { <variablelist class="dbus-property" generated="True" extra-ref="RestrictNetworkInterfaces"/> + <variablelist class="dbus-property" generated="True" extra-ref="ControlGroupNFTSet"/> + <variablelist class="dbus-property" generated="True" extra-ref="Environment"/> <variablelist class="dbus-property" generated="True" extra-ref="EnvironmentFiles"/> @@ -6282,6 +6294,8 @@ node /org/freedesktop/systemd1/unit/home_2emount { @org.freedesktop.DBus.Property.EmitsChangedSignal("false") readonly (bas) RestrictNetworkInterfaces = ...; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") + readonly a(iss) ControlGroupNFTSet = [...]; + @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly as Environment = ['...', ...]; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly a(sb) EnvironmentFiles = [...]; @@ -6805,6 +6819,8 @@ node /org/freedesktop/systemd1/unit/home_2emount { <!--property RestrictNetworkInterfaces is not documented!--> + <!--property ControlGroupNFTSet is not documented!--> + <!--property EnvironmentFiles is not documented!--> <!--property PassEnvironment is not documented!--> @@ -7297,6 +7313,8 @@ node /org/freedesktop/systemd1/unit/home_2emount { <variablelist class="dbus-property" generated="True" extra-ref="RestrictNetworkInterfaces"/> + <variablelist class="dbus-property" generated="True" extra-ref="ControlGroupNFTSet"/> + <variablelist class="dbus-property" generated="True" extra-ref="Environment"/> <variablelist class="dbus-property" generated="True" extra-ref="EnvironmentFiles"/> @@ -8050,6 +8068,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap { @org.freedesktop.DBus.Property.EmitsChangedSignal("false") readonly (bas) RestrictNetworkInterfaces = ...; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") + readonly a(iss) ControlGroupNFTSet = [...]; + @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly as Environment = ['...', ...]; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly a(sb) EnvironmentFiles = [...]; @@ -8559,6 +8579,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap { <!--property RestrictNetworkInterfaces is not documented!--> + <!--property ControlGroupNFTSet is not documented!--> + <!--property EnvironmentFiles is not documented!--> <!--property PassEnvironment is not documented!--> @@ -9037,6 +9059,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap { <variablelist class="dbus-property" generated="True" extra-ref="RestrictNetworkInterfaces"/> + <variablelist class="dbus-property" generated="True" extra-ref="ControlGroupNFTSet"/> + <variablelist class="dbus-property" generated="True" extra-ref="Environment"/> <variablelist class="dbus-property" generated="True" extra-ref="EnvironmentFiles"/> @@ -9648,6 +9672,8 @@ node /org/freedesktop/systemd1/unit/system_2eslice { readonly a(iiqq) SocketBindDeny = [...]; @org.freedesktop.DBus.Property.EmitsChangedSignal("false") readonly (bas) RestrictNetworkInterfaces = ...; + @org.freedesktop.DBus.Property.EmitsChangedSignal("const") + readonly a(iss) ControlGroupNFTSet = [...]; }; interface org.freedesktop.DBus.Peer { ... }; interface org.freedesktop.DBus.Introspectable { ... }; @@ -9800,6 +9826,8 @@ node /org/freedesktop/systemd1/unit/system_2eslice { <!--property RestrictNetworkInterfaces is not documented!--> + <!--property ControlGroupNFTSet is not documented!--> + <!--Autogenerated cross-references for systemd.directives, do not edit--> <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.systemd1.Unit"/> @@ -9958,6 +9986,8 @@ node /org/freedesktop/systemd1/unit/system_2eslice { <variablelist class="dbus-property" generated="True" extra-ref="RestrictNetworkInterfaces"/> + <variablelist class="dbus-property" generated="True" extra-ref="ControlGroupNFTSet"/> + <!--End of Autogenerated section--> <refsect2> @@ -10138,6 +10168,8 @@ node /org/freedesktop/systemd1/unit/session_2d1_2escope { @org.freedesktop.DBus.Property.EmitsChangedSignal("false") readonly (bas) RestrictNetworkInterfaces = ...; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") + readonly a(iss) ControlGroupNFTSet = [...]; + @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly s KillMode = '...'; @org.freedesktop.DBus.Property.EmitsChangedSignal("const") readonly i KillSignal = ...; @@ -10307,6 +10339,8 @@ node /org/freedesktop/systemd1/unit/session_2d1_2escope { <!--property RestrictNetworkInterfaces is not documented!--> + <!--property ControlGroupNFTSet is not documented!--> + <!--property KillMode is not documented!--> <!--property KillSignal is not documented!--> @@ -10493,6 +10527,8 @@ node /org/freedesktop/systemd1/unit/session_2d1_2escope { <variablelist class="dbus-property" generated="True" extra-ref="RestrictNetworkInterfaces"/> + <variablelist class="dbus-property" generated="True" extra-ref="ControlGroupNFTSet"/> + <variablelist class="dbus-property" generated="True" extra-ref="KillMode"/> <variablelist class="dbus-property" generated="True" extra-ref="KillSignal"/> |