Daan De Meyer
4bbdc8a6a2
Add a new --restrict-address-families= command line option and corresponding RestrictAddressFamilies= setting for .nspawn files to restrict which socket address families may be used inside a container. Many address families such as AF_VSOCK and AF_NETLINK are not network-namespaced, so restricting access to them in containers improves isolation. The option supports allowlist and denylist modes (via ~ prefix), as well as "none" to block all families, matching the semantics of RestrictAddressFamilies= in unit files. The address family parsing logic is extracted into a shared parse_address_families() helper in parse-helpers.c, which is now also used by config_parse_address_families() in load-fragment.c. This is currently opt-in. In a future version, the default will be changed to restrict address families to AF_INET, AF_INET6 and AF_UNIX.
43 lines
1.4 KiB
C
43 lines
1.4 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
#pragma once
|
|
|
|
#include "shared-forward.h"
|
|
|
|
typedef enum PathSimplifyWarnFlags {
|
|
PATH_CHECK_FATAL = 1 << 0, /* If not set, then error message is appended with 'ignoring'. */
|
|
PATH_CHECK_ABSOLUTE = 1 << 1,
|
|
PATH_CHECK_RELATIVE = 1 << 2,
|
|
PATH_KEEP_TRAILING_SLASH = 1 << 3,
|
|
PATH_CHECK_NON_API_VFS = 1 << 4,
|
|
PATH_CHECK_NON_API_VFS_DEV_OK = 1 << 5,
|
|
} PathSimplifyWarnFlags;
|
|
|
|
int path_simplify_and_warn(
|
|
char *path,
|
|
PathSimplifyWarnFlags flags,
|
|
const char *unit,
|
|
const char *filename,
|
|
unsigned line,
|
|
const char *lvalue);
|
|
|
|
int parse_address_families(const char *rvalue, Set **families, bool *is_allowlist);
|
|
|
|
int parse_socket_bind_item(
|
|
const char *str,
|
|
int *address_family,
|
|
int *ip_protocol,
|
|
uint16_t *nr_ports,
|
|
uint16_t *port_min);
|
|
|
|
int config_parse_path_or_ignore(
|
|
const char *unit,
|
|
const char *filename,
|
|
unsigned line,
|
|
const char *section,
|
|
unsigned section_line,
|
|
const char *lvalue,
|
|
int ltype,
|
|
const char *rvalue,
|
|
void *data,
|
|
void *userdata);
|