mirror of
https://github.com/systemd/systemd.git
synced 2025-01-10 05:18:17 +03:00
3cf63830ac
New directive `NetLabel=` provides a method for integrating dynamic network
configuration into Linux NetLabel subsystem rules, used by Linux security
modules (LSMs) for network access control. The option expects a whitespace
separated list of NetLabel labels. The labels must conform to lexical
restrictions of LSM labels. When an interface is configured with IP addresses,
the addresses and subnetwork masks will be appended to the NetLabel Fallback
Peer Labeling rules. They will be removed when the interface is
deconfigured. Failures to manage the labels will be ignored.
Example:
```
[DHCP]
NetLabel=system_u:object_r:localnet_peer_t:s0
```
With the above rules for interface `eth0`, when the interface is configured with
an IPv4 address of 10.0.0.0/8, `systemd-networkd` performs the equivalent of
`netlabelctl` operation
```
$ sudo netlabelctl unlbl add interface eth0 address:10.0.0.0/8 label:system_u:object_r:localnet_peer_t:s0
```
Result:
```
$ sudo netlabelctl -p unlbl list
...
interface: eth0
address: 10.0.0.0/8
label: "system_u:object_r:localnet_peer_t:s0"
...
```
|
||
|---|---|---|
| .. | ||
| fuzz-bootspec | ||
| fuzz-bus-match | ||
| fuzz-bus-message | ||
| fuzz-calendarspec | ||
| fuzz-catalog | ||
| fuzz-dhcp6-client | ||
| fuzz-dhcp-client | ||
| fuzz-dhcp-server | ||
| fuzz-dhcp-server-relay | ||
| fuzz-dns-packet | ||
| fuzz-env-file | ||
| fuzz-etc-hosts | ||
| fuzz-fido-id-desc | ||
| fuzz-journal-remote | ||
| fuzz-journald-audit | ||
| fuzz-journald-kmsg | ||
| fuzz-journald-native-fd | ||
| fuzz-journald-stream | ||
| fuzz-journald-syslog | ||
| fuzz-json | ||
| fuzz-link-parser | ||
| fuzz-lldp-rx | ||
| fuzz-ndisc-rs | ||
| fuzz-netdev-parser | ||
| fuzz-network-parser | ||
| fuzz-nspawn-oci | ||
| fuzz-nspawn-settings | ||
| fuzz-systemctl-parse-argv | ||
| fuzz-udev-database | ||
| fuzz-udev-rules | ||
| fuzz-unit-file | ||
| fuzz-varlink | ||
| fuzz-xdg-desktop | ||
| .gitattributes | ||
| meson.build | ||