From 6359811021f113e8ba782be3fbdfa0b587a7bebd Mon Sep 17 00:00:00 2001 From: Julia Kartseva Date: Wed, 18 Nov 2020 00:32:14 -0800 Subject: [PATCH] man: add SocketBind{Allow|Deny}= documentation --- man/systemd.resource-control.xml | 70 ++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml index a2d01f7afb..d9b570e232 100644 --- a/man/systemd.resource-control.xml +++ b/man/systemd.resource-control.xml @@ -762,6 +762,76 @@ BPFProgram=bind6:/sys/fs/bpf/sock-addr-hook + + SocketBindAllow=bind-rule + SocketBindDeny=bind-rule + + + Allow or deny binding a socket address to a socket by matching it with the bind-rule and + applying a corresponding action if there is a match. + + bind-rule describes socket properties such as address-family + and ip-ports. + + bind-rule := [address-family:]ip-ports + + address-family := { IPv4 | IPv6 } + + ip-ports := { ip-port | ip-port-range | + any } + + An optional address-family expects IPv4 or IPv6 values. + If not specified, a rule will be matched for both IPv4 and IPv6 addresses and applied depending on other socket fields, e.g. + ip-port. + + ip-port value must lie within 1…65535 interval inclusively, i.e. + dynamic port 0 is not allowed. A range of sequential ports is described by + ip-port-range := ip-port-low-ip-port-high, + where ip-port-low is smaller than or equal to ip-port-high + and both are within 1…65535 inclusively. A special value any + should be used to apply a rule to any port with a positive value. + + To allow multiple rules assign SocketBindAllow= or SocketBindDeny= multiple times. + To clear the existing assignments pass an empty SocketBindAllow= or SocketBindDeny= + assignment. + + For each of SocketBindAllow= and SocketBindDeny=, maximum allowed number of assignments is + 128. + + + Binding to a socket is allowed when a socket address matches an entry in the + SocketBindAllow= list. + + Otherwise, binding is denied when the socket address matches an entry in the + SocketBindDeny= list. + + Otherwise, binding is allowed. + + + The feature is implemented with cgroup/bind4 and cgroup/bind6 cgroup-bpf hooks. + Examples:… +# Allow binding IPv6 socket addresses with a port greater than or equal to 10000. +[Service] +SocketBindAllow=IPv6:10000-65535 +SocketBindDeny=any +… +# Allow binding IPv4 and IPv6 socket addresses with 1234 and 4321 ports. +[Service] +SocketBindAllow=1234 +SocketBindAllow=4321 +SocketBindDeny=any +… +# Deny binding IPv6 socket addresses. +[Service] +SocketBindDeny=IPv6:any +… +# Deny binding IPv4 and IPv6 socket addresses. +[Service] +SocketBindDeny=any +… + + + DeviceAllow=