diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml
index a2d01f7afb..d9b570e232 100644
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@@ -762,6 +762,76 @@ BPFProgram=bind6:/sys/fs/bpf/sock-addr-hook
+
+ SocketBindAllow=bind-rule
+ SocketBindDeny=bind-rule
+
+
+ Allow or deny binding a socket address to a socket by matching it with the bind-rule and
+ applying a corresponding action if there is a match.
+
+ bind-rule describes socket properties such as address-family
+ and ip-ports.
+
+ bind-rule := [address-family:]ip-ports
+
+ address-family := { IPv4 | IPv6 }
+
+ ip-ports := { ip-port | ip-port-range |
+ any }
+
+ An optional address-family expects IPv4 or IPv6 values.
+ If not specified, a rule will be matched for both IPv4 and IPv6 addresses and applied depending on other socket fields, e.g.
+ ip-port.
+
+ ip-port value must lie within 1…65535 interval inclusively, i.e.
+ dynamic port 0 is not allowed. A range of sequential ports is described by
+ ip-port-range := ip-port-low-ip-port-high,
+ where ip-port-low is smaller than or equal to ip-port-high
+ and both are within 1…65535 inclusively. A special value any
+ should be used to apply a rule to any port with a positive value.
+
+ To allow multiple rules assign SocketBindAllow= or SocketBindDeny= multiple times.
+ To clear the existing assignments pass an empty SocketBindAllow= or SocketBindDeny=
+ assignment.
+
+ For each of SocketBindAllow= and SocketBindDeny=, maximum allowed number of assignments is
+ 128.
+
+
+ Binding to a socket is allowed when a socket address matches an entry in the
+ SocketBindAllow= list.
+
+ Otherwise, binding is denied when the socket address matches an entry in the
+ SocketBindDeny= list.
+
+ Otherwise, binding is allowed.
+
+
+ The feature is implemented with cgroup/bind4 and cgroup/bind6 cgroup-bpf hooks.
+ Examples:…
+# Allow binding IPv6 socket addresses with a port greater than or equal to 10000.
+[Service]
+SocketBindAllow=IPv6:10000-65535
+SocketBindDeny=any
+…
+# Allow binding IPv4 and IPv6 socket addresses with 1234 and 4321 ports.
+[Service]
+SocketBindAllow=1234
+SocketBindAllow=4321
+SocketBindDeny=any
+…
+# Deny binding IPv6 socket addresses.
+[Service]
+SocketBindDeny=IPv6:any
+…
+# Deny binding IPv4 and IPv6 socket addresses.
+[Service]
+SocketBindDeny=any
+…
+
+
+
DeviceAllow=