Topi Miettinen
c0548df0a2
core: firewall integration with ControlGroupNFTSet=
New directive `ControlGroupNFTSet=` provides a method for integrating services
into firewall rules with NFT sets.
Example:
```
table inet filter {
...
set timesyncd {
type cgroupsv2
}
chain ntp_output {
socket cgroupv2 != @timesyncd counter drop
accept
}
...
}
```
/etc/systemd/system/systemd-timesyncd.service.d/override.conf
```
[Service]
ControlGroupNFTSet=inet:filter:timesyncd
```
```
$ sudo nft list set inet filter timesyncd
table inet filter {
set timesyncd {
type cgroupsv2
elements = { "system.slice/systemd-timesyncd.service" }
}
}
```
2022-06-08 16:12:25 +00:00
..
2022-05-08 17:58:00 +02:00
2021-03-06 09:32:18 +01:00
2022-05-28 10:06:14 +02:00
2022-05-10 14:35:57 +02:00
2022-03-21 11:42:35 +01:00
2022-05-04 11:51:15 +02:00
2022-05-04 11:51:15 +02:00
2022-03-21 11:42:35 +01:00
2022-03-21 11:43:47 +01:00
2020-12-30 04:14:22 +09:00
2019-03-11 14:11:28 +01:00
2022-05-20 15:18:28 +02:00
2019-09-07 02:23:58 +09:00
2022-05-04 11:51:15 +02:00
2018-11-17 11:25:19 +01:00
2022-05-04 11:51:15 +02:00
2018-11-23 17:29:59 +01:00
2018-11-20 03:03:32 +01:00
2022-05-10 17:08:37 +02:00
2022-02-17 23:10:26 +09:00
2021-09-27 23:55:11 +09:00
2022-05-16 00:25:18 +01:00
2022-06-01 04:02:48 +09:00
2022-06-08 16:12:25 +00:00
2019-03-22 17:39:12 +01:00
2022-05-04 11:51:15 +02:00
2021-05-31 19:29:07 +02:00
2019-02-26 13:28:30 +09:00
2021-07-01 16:50:15 +02:00
2022-06-08 16:12:25 +00:00
2019-05-17 15:09:32 +02:00
2020-07-07 12:20:43 +02:00
2021-10-18 09:42:55 +02:00
2022-02-22 17:50:14 +00:00