diff options
author | Topi Miettinen <toiwoton@gmail.com> | 2022-05-22 15:17:24 +0300 |
---|---|---|
committer | Topi Miettinen <topimiettinen@users.noreply.github.com> | 2022-06-08 16:12:25 +0000 |
commit | 46c3b1ff887e096f89cb1eae9b2567c5dd4272d3 (patch) | |
tree | f834624ca67c0a8b8dbf586dcbb6b1a3a14045c0 /man/systemd.exec.xml | |
parent | c0548df0a2f78f3422d77c77c2149d8a7f50d8f6 (diff) | |
download | systemd-46c3b1ff887e096f89cb1eae9b2567c5dd4272d3.tar.gz |
core: firewall integration with DynamicUserNFTSet=
New directive `DynamicUserNFTSet=` provides a method for integrating
configuration of dynamic users into firewall rules with NFT sets.
Example:
```
table inet filter {
set u {
typeof meta skuid
}
chain service_output {
meta skuid != @u drop
accept
}
}
```
```
/etc/systemd/system/dunft.service
[Service]
DynamicUser=yes
DynamicUserNFTSet=inet:filter:u
ExecStart=/bin/sleep 1000
[Install]
WantedBy=multi-user.target
```
```
$ sudo nft list set inet filter u
table inet filter {
set u {
typeof meta skuid
elements = { 64864 }
}
}
$ ps -n --format user,group,pid,command -p `pgrep sleep`
USER GROUP PID COMMAND
64864 64864 55158 /bin/sleep 1000
```
Diffstat (limited to 'man/systemd.exec.xml')
-rw-r--r-- | man/systemd.exec.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 50c5c89703..9798a8d999 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -3164,6 +3164,40 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX </refsect1> <refsect1> + <title>Firewall Integration</title> + <variablelist class='unit-directives'> + + <varlistentry> + <term><varname>DynamicUserNFTSet=</varname><replaceable>family</replaceable>:<replaceable>table</replaceable>:<replaceable>set</replaceable></term> + <listitem><para>This setting provides a method for integrating <varname>DynamicUser=</varname> + configuration into firewall rules with NFT sets. This option expects a whitespace separated list of + NFT set definitions. Each definition consists of a colon-separated tuple of NFT address family (one + of <literal>arp</literal>, <literal>bridge</literal>, <literal>inet</literal>, <literal>ip</literal>, + <literal>ip6</literal>, or <literal>netdev</literal>), table name and set name. The names of tables + and sets must conform to lexical restrictions of NFT table names. When the unit starts, the user ID + will be appended to the NFT sets and it will be removed when the unit is stopped. Failures to manage + the sets will be ignored.</para> + + <para>Example: + <programlisting>[Service] +DynamicUserNFTSet=inet:filter:u</programlisting> + Corresponding NFT rules: + <programlisting>table inet filter { + set u { + typeof meta skuid + } + chain service_output { + meta skuid != @u drop + accept + } +}</programlisting> + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1> <title>System V Compatibility</title> <variablelist class='unit-directives'> |